Malware Analysis with ClamAV in Netsparker Enterprise

In order to enable a Netsparker Enterprise scan agent to carry out malware analysis for your web application, you need to download and install ClamAV.

ClamAV is an open-source, free, and widely used project backed by Cisco.

In order to enable Netsparker Enterprise to perform malware analysis, see Malware Analyzer.

ClamAV is optional. If you want a Netsparker Enterprise agent to identify malware, you need to use it.
Please note that you may need administrator privileges to run the following operations.

How to Set ClamAV as a Windows Service

1. From ClamAV, download the program relevant to your environment

2. Extract .zip file to a folder
3. Navigate to the conf_examples folder and copy the clamd.conf.sample and the freshclam.conf.sample file

4. Paste the clamd.conf.sample and freshclam.conf.sample files into the ClamAV's main folder and delete .sample extension from the files. The Rename popup is displayed. Click Yes.
5. Open the freshclam.conf file with a text editor, and edit Log and Database directories, if necessary. Remove hashtags from the Log and Database lines.

6. Now, open Command Prompt and navigate to the extracted folder
7. Run freshclam.exe to update the ClamAV

8. Next, run clamd install to configure ClamAV as a windows service
9. Now, run sc config Clamd start auto so that the ClamAV service starts automatically
10. Then, run sc config FreshClam start auto so that the ClamAV virus update service starts automatically.

How to Set ClamAV as a Linux Service

1. Open terminal
2. Run sudo apt-get install clamav clamav-daemon

You may want to run sudo apt update & sudo apt upgrade first before installing ClamAV to update your system.

3. Run sudo nano /etc/clamav/freshclam.conf and increase ReceiveTimeout to 300
4. Run sudo systemctl restart clamav-freshclam to apply the changed configuration. Then, you may wait 2 - 3 minutes so that ClamAV updates the virus database.
5. Run sudo nano /etc/clamav/clamd.conf in order to edit the file.

• Then, delete the following entries from the clamd.conf file:

• LocalSocket /var/run/clamav/clamd.ctl
• FixStaleSocket true
• LocalSocketGroup clamav
• LocalSocketMode 666

• And, add the following entries to the clamd.config file:

• TCPSocket 3310
• TCPAddr 127.0.0.1

6. Run sudo systemctl restart clamav-daemon to apply changed configurations.

You can run sudo apt --purge autoremove clamav-daemon to uninstall ClamAV from your machine.

After the installation, you can run a test to confirm that ClamAV is working as expected.

How to test ClamAV

1. Open terminal
2. Run wget https://secure.eicar.org/eicar.com.txt
3. Run sudo clamdscan

4. echo VERSION | nc -v 127.0.0.1 3310
5. echo "SCAN ~/eicar.com.txt" | nc -v 127.0.0.1 3310