How To Integrate ClamAV Into PureFTPd For Virus Scanning On Fedora 14

This tutorial explains how you can integrate ClamAV into PureFTPd for virus scanning on a Fedora 14 system. In the end, whenever a file gets uploaded through PureFTPd, ClamAV will check the file and delete it if it is malware.

I do not issue any guarantee that this will work for you!

You should have a working PureFTPd setup on your Fedora 14 server, e.g. as shown in this tutorial: Virtual Hosting With PureFTPd And MySQL (Incl. Quota And Bandwidth Management) On Fedora 14.

ClamAV can be installed as follows:

yum install amavisd-new clamav clamav-data clamav-server clamav-update clamav-scanner

Clamdscan expects the configuration file /etc/clamd.conf which doesn't exist - therefore we create a symlink from /etc/clamd.conf to /etc/clamd.d/amavisd.conf:

ln -s /etc/clamd.d/amavisd.conf /etc/clamd.conf

Next we create the system startup links for clamd and start it:

chkconfig --levels 235 clamd.amavisd on
/etc/init.d/clamd.amavisd start

First we open /etc/pure-ftpd/pure-ftpd.conf and set CallUploadScript to yes :

vi /etc/pure-ftpd/pure-ftpd.conf

[...]# If your pure-ftpd has been compiled with pure-uploadscript support,# this will make pure-ftpd write info about new uploads to# /var/run/pure-ftpd.upload.pipe so pure-uploadscript can read it and# spawn a script to handle the upload.CallUploadScript yes[...]

Next we create the file /etc/pure-ftpd/clamav_check.sh (which will call /usr/bin/clamdscan whenever a file is uploaded through PureFTPd)...

vi /etc/pure-ftpd/clamav_check.sh

#!/bin/sh/usr/bin/clamdscan --remove --quiet --no-summary "$1"

... and make it executable:

chmod 755 /etc/pure-ftpd/clamav_check.sh

Now we start the pure-uploadscript program as a daemon - it will call our /etc/pure-ftpd/clamav_check.sh script whenever a file is uploaded through PureFTPd:

pure-uploadscript -B -r /etc/pure-ftpd/clamav_check.sh

Of course, you don't want to start the daemon manually each time you boot the system - therefore we open /etc/rc.local...

vi /etc/rc.local

... and add the line /usr/sbin/pure-uploadscript -B -r /etc/pure-ftpd/clamav_check.sh to it - e.g. as follows:

#!/bin/sh## This script will be executed *after* all the other init scripts.# You can put your own initialization stuff in here if you don't# want to do the full Sys V style init stuff./usr/sbin/pure-uploadscript -B -r /etc/pure-ftpd/clamav_check.shtouch /var/lock/subsys/local

Finally we restart PureFTPd:

/etc/init.d/pure-ftpd restart

That's it! Now whenever someone tries to upload malware to your server through PureFTPd, the "bad" file(s) will be silently deleted.

ThinkPoint Virus Removal Tutorial

ThinkPoint is another release of a professionally-looking rogue antivirus program manufactured by scammers that might have originated from Asia or Russia. The fraudulent application will pretend to perform system scans and will detect the presence of critical viruses. Next, it will offer a solution in the form of an upgrade to the full version of the ThinkPoint program which promises to unlock all the features, but, can eventually do nothing. Many who have been fooled into this kind of online scam have been convinced because they have experienced lots of errors like the slowing down of their computer, features of Windows being disabled and the presence of several pop-ups that never cease to come. This infection should be purged from your system. This tutorial will teach you how to get rid of the ThinkPoint virus from your PC.

ThinkPoint is actually one of those smart viruses that brazenly show as an antivirus interface. It is regarded as a piece of malware or malicious software. Aside from causing severe errors in your computer, it can possibly help the hackers behind it to gain access to personal information stored in your computer. As long as this program is installed on your computer, it will continue to wreak havoc and prompt you to purchase the false upgrade. You need to get rid of the virus to stop the infection from damaging your system and possibly infecting other computers.

How To Remove ThinkPoint From Your PC

The conventional way in removing the ThinkPoint Virus from your system is enumerated in 2 steps. Your first step is to close the ThinkPoint application which also means stopping the virus from running in your system, and then carefully removing the program files of the virus. If you have tried exiting from the application using the normal processes, you might have found out that it is quite difficult to do especially since Task Manager has been disabled by the virus. You need to go reboot and enter Windows using "Safe Mode" or use a process killer program like "rkill" to terminate the processes the virus uses to run properly. Only after successfully disabling the processes of the virus can you start deleting program entries to prevent the infection from returning. The 2-step process can be quite challenging to many PC users.

This virus will install itself here:

C:\Documents and Settings\User\Application Data\hotfix.exe

The most effective method in removing the ThinkPoint Virus with relative ease to the user is by using an "anti-malware" program that can detect the virus entries and has the ability to clean the infection thoroughly. From among the many tools available, our tests show that an application called "Frontline Rogue Remover" is the most effective in stopping the ThinkPoint virus. The application first shows you how to stop the virus, and then completely removes it for good. By using Frontline Rogue Remover, you are also protecting your computer from future malware infection.