Virus scanner for attachments

[bahisyeri]

Hello guys and gals,
I was seeking for virus scanner addon for vBulletin 3.6.x , i found out one product for 3.5.8 Jafo232's addon (https://vborg.vbsupport.ru/showthread.php?t=101090) but it was using fprot which is needing license and not free. So i decided do make it for 3.6.x and using LibClamAV.
It works fine and it's simple.
Here you go.
Thanks Jafo232 for his addon and idea and cheesegrits for his sample.

What does this plugin do?
This plugin let you have virus scanner for your forum's attachment managing.

Installing
Open your admin control panel and then
Plugin System -> Manage Products -> [Add/Import Product] -> Select 'product-vscan.xml' from your computer then press 'Import'
This plugin uses ClamAV for scanning files there is two method available for scanning:
First method requires LibClamAV support on your php settings. You can check it on phpinfo. If you do not have ClamAV , You can download it free at here (http://www.clamav.net) and faster than second method.If you can not find php-clamav due to problems from its publisher server. You can download php-clamavlib-0.13-src.zip (https://vborg.vbsupport.ru/attachment.php?attachmentid=80926&d=1211170101) which i attached or you can download compiled version clamav.zip (https://vborg.vbsupport.ru/attachment.php?attachmentid=80927&d=1211170101) or if you are using Debian based system just type apt-get install php5-clamavlib on your shell.
Second method uses clamscan binary of ClamAV does not require LibClamAV just installing ClamAV enough for it but its a bit slower than first method.
Please feel free to ask any questions
This may be copied, reproduced or published anywhere without my permission.
Current version: 0.2a
File name: plugin-vscan2.xml
Change history:
0.2a: Added function for scanning file if php does not have ClamAV support this function uses clamscan and no need libclamav support just installing ClamAV enough for this somehow its a bit slower than php-clamav module, and installing php-clamav strongly suggested.Who is using 0.1a and having php-clamav on their system do not need update because there is no change for php-clamav support but if you want to feel better you can update it.
0.1a: Addon written based from Jafo232's old but changed scanning method for using libclamav

[Shazz]

So every member has to have ClamAV in able for this to work for them?

[bahisyeri]

So every member has to have ClamAV in able for this to work for them?

If you mean forum members on your forum , no your host must have clamav.

[Shazz]

If you mean forum members on your forum , no your host must have clamav.

Looks nice to have, might try it out! Thanks.

[bahisyeri]

Please feel free to ask questions and please reply if you downloaded and tried it out let us know for it's bugs if you found and for your thoughts for improvement.

[cjshirlaw]

so if someone uploads an attachment it scans it for viruses and if it does it posts it in the box?

[bahisyeri]

so if someone uploads an attachment it scans it for viruses and if it does it posts it in the box?

Yeah thats right, While uploading it scans the file on temp and if it contains virus plugin cancel uploading and let the user get error message about virus alert.

[yahoooh]

great plugin

[Skyline_GT]

Will this cause a lot of server load when scanning for virus?

[bahisyeri]

Will put cause a lot of server load?

Well ClamAV is dynamic extension and we are using it on only for uploads, i do not think so u'll get huge loads coz of it even if you do not use it on ur smtpd and popd servers but it wont make huge loads on them too if you do not have so big incoming and outgoing traffic.
so for uploads it wont make huge load.

[SuperTaz]

Installed. Thank you :)

[Hornstar]

Some virus alerts are harmless tho, so this would stop many useful attachments. wouldn't it be better for the virus scan alert to be attached to the post, and let the user decide if it is harmless or dangerous and a disclaimer next to the download button. That would be a very cool mod.

[bahisyeri]

Well believe me ClamAV best free solution with It's new virus database.
For example it will never logs NetCat as a trojan/virus. It's just one example maybe many of them knows it NetCat is program like telnet.

[Awjvail]

This may be useful. I'll bookmark this for later. :) Thanks.

[andrewy3k]

Looks good, but I'm wondering if there is a better alternative to ClamAV?

[bahisyeri]

Looks good, but I'm wondering if there is a better alternative to ClamAV?

well clamav is having php module so we do not need running system command coz of it.

[projectego]

* projectego clicks install! :D

[yoyoyoyo]

well clamav is having php module so we do not need running system command coz of it.so does that mean that if I am on a shared server I can simply upload the clamav php files to my site myself? sorry I am a bit confused...

[kaptanblack]

Thanks....

[bahisyeri]

so does that mean that if I am on a shared server I can simply upload the clamav php files to my site myself? sorry I am a bit confused...

hm if you on shared host u can try use function dl and force loading module but talk with your host and they must have clamav on their module list coz every host is installing it for mail management

[nfn]

Hi,

this looks like a great mod, but is there a way to scan the file without LibClamAV?

[Snake]

That's what I'd like to know as well.

[bahisyeri]

Sure we can do it but as i said i prefer ClamAV because it has extension for php otherwise i dont know any antivir with php extension so we need to make some system base codes for example you can download AVG 7.5 Free for linux and when you wanna scan with it code might be like this

$var=system("avgscan -arch $file");
preg_match("/Virus found phrase/si", $var, $result);
if ($result) { code ... }

[djbaxter]

Looks good, but I'm wondering if there is a better alternative to ClamAV?

What's wrong or lacking in ClamAV? I have it on my VPS (installed by default) and it's updated nightly. I don't know a whole lot about it, to be honest, so I'm wondering if you know of anything to suggest it's unreliable.

[yoyoyoyo]

hm if you on shared host u can try use function dl and force loading module but talk with your host and they must have clamav on their module list coz every host is installing it for mail managementI checked with my host and they aren't offering it. Do I need shell access to use the dl function?

[bahisyeri]

I checked with my host and they aren't offering it. Do I need shell access to use the dl function?

Nope you do not need but u need to check did they enable this function for you in php.ini,
http://tr2.php.net/dl here is its usage and examples.
Between did you ask them for installing?

[lasto]

so when new viruses come out the virus checker will need to be updated - aint it easy just to download them and have a virus checker on your comp that auto scans any incoming files.

[bahisyeri]

so when new viruses come out the virus checker will need to be updated - aint it easy just to download them and have a virus checker on your comp that auto scans any incoming files.

ClamAV has this option on virtualbox i recommend installing freshclam it works as a daemon and its doesnt eat so much resources actually it doesnt eat any :)

[WhaLberg]

bahisyeri, I really liked the idea. Congratulations, rated excellent.

[djbaxter]

so when new viruses come out the virus checker will need to be updated - aint it easy just to download them and have a virus checker on your comp that auto scans any incoming files.

Not really.

First, since this is part of the PHP installation, on my VPS I have a cron job running nightly to update everything that needs to be updated and ClamAV is one of those modules - it may add a few seconds to the updates if installed but that's all.

Second, I think your forum members would be happier knowing that you are taking some steps to minimize the risk of downloading malware from your site.

Third, it will help you to avoid flags that increasingly get attached to sites, e.g., McAfee's site warnings and Google's.

I think this add-on is a great idea. :up:

[Saviour]

I'm a little confused, as well.

So if my host has installed LibClamAV on my server...all I have to do is Import this product and it will scan uploads and downloads as well as automatically updating itself with the latest virus definitions? Am I correct in assuming this?

[bahisyeri]

I'm a little confused, as well.

So if my host has installed LibClamAV on my server...all I have to do is Import this product and it will scan uploads and downloads as well as automatically updating itself with the latest virus definitions? Am I correct in assuming this?

Hi,
When your host install LibClamAV to your host , they will install php extension for clamav and with this plugin we hook uploading process and checking the file uploading from user by clamav's extension. I know you are getting confused why its only 1.8kb coz all code we need for scan is already in extension :).
We can make some codes for other antivirs too i show lil example in previous page but many of them do not have extension for php so we need to use commands like system which is denied by many shared hosts.

[djbaxter]

Installed and just tested it with an upload. It gives me this error:

Fatal error: Call to undefined function: cl_scanfile_ex() in /home/{domain obscured}/public_html/{folder obscured}/newattachment.php(159) : eval()'d code on line 19

ClamAV is installed on the server.

[apiasto]

looks pretty cool,but what about the anti-virus software which comes with hosting package.would it be any difference in thse two?

[bahisyeri]

Installed and just tested it with an upload. It gives me this error:



ClamAV is installed on the server.

You also need install php extension of it. http://www.phpclamavlib.org/ as i said it uses LibClamAV :)

looks pretty cool,but what about the anti-virus software which comes with hosting package.would it be any difference in thse two?

Well for now this plugin just uses ClamAV.

[mystic10]

i have downloaded ClamAV now where do i upload it i am confused please help

[Saviour]

Hi,
When your host install LibClamAV to your host , they will install php extension for clamav and with this plugin we hook uploading process and checking the file uploading from user by clamav's extension. I know you are getting confused why its only 1.8kb coz all code we need for scan is already in extension :).
We can make some codes for other antivirs too i show lil example in previous page but many of them do not have extension for php so we need to use commands like system which is denied by many shared hosts.


This explanation just adds to the confusion of your mod.

No offense, but you might want to give a little more specifics in your mod...or just remove it entirely as not to consfuse the layman from screwing up their own forum.

You have to admit, your grammar isn't the best English I've seen. I don't mean that in a racist way. I just think a little better sentence structure and grammar would help all the users interested in this mod. Along with a better explanation of how to install and use it would benefit the whole community...don't you think?

[bahisyeri]

This explanation just adds to the confusion of your mod.

No offense, but you might want to give a little more specifics in your mod...or just remove it entirely as not to consfuse the layman from screwing up their own forum.

You have to admit, your grammar isn't the best English I've seen. I don't mean that in a racist way. I just think a little better sentence structure and grammar would help all the users interested in this mod. Along with a better explanation of how to install and use it would benefit the whole community...don't you think?

Hi,
Ofcourse my English isn't the best one because i'm son of Turkish dad and Swedish mom anyway. You are right for mod instruction but as i said the functions of this mod using are came with LibClamAV and it's php extension which must be installed by adminstrators of your system.

[semauae]

thnx alot

can I publish it in an arabic forums ?

[bahisyeri]

thnx alot

can I publish it in an arabic forums ?

Sure, as i posted in 1st message

This may be copied, reproduced or published anywhere without my permission.

[Skyline_GT]

<a href="http://www.phpclamavlib.org/" target="_blank">http://www.phpclamavlib.org/</a> is down

[fm5]

does it kill the virii when found?

[bahisyeri]

does it kill the virii when found?

It kills upload process if file having virus.

[ParsianSat_Net]

Dear
my server in used clam anti virus
I am will set up product , no problem?

[bahisyeri]

ParsianSat_Net,
Check your phpinfo if there is clamav you dont need to install it just install product and everything will be done but if there is not clamav in your php settings and clamav installed on your server you must install php extension of clamav.

[ParsianSat_Net]

Dear,
We installed clamav on server.
Now do we need to product?
if we will install , no problem?
Thanks a lot

[ParsianSat_Net]

Do product have spcial setting?
do it work and clean atumatic ly?

[ParsianSat_Net]

How we underestand is virus?

[FractalizeR]

Dear,
We installed clamav on server.
Now do we need to product?
if we will install , no problem?
Thanks a lot

You need to have CLAMAV PHP Extension for PHP in order to use this product!

[yahoooh]

You need to have CLAMAV PHP Extension for PHP in order to use this product!
i have on myserver clamv by WHM but how to install php extension?

[mystic10]

how do u go about updating everything that needs to be updated...how can i run a cron job nightly..please guide

[bahisyeri]

how do u go about updating everything that needs to be updated...how can i run a cron job nightly..please guide

If you mean for virus databases, ClamAV has program named freshclam which checks updates everyday.For debian users you can install freshclam like this,

aptitude install clamav-freshclam

Other users please check ClamAV (http://www.clamav.org)'s main site for freshclam.

[lood]

Installed method2, clamscan detects the threat but the plugin does not !