Generic checks
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
ps aux |grep sav (check process) /opt/sophos-av/bin/savdstatus --version (version, last update, thread data) /opt/sophos-av/bin/savconfig -v (info about exclusions, where the Datacentre is that hosts that Sophos device, named scans etc ) /opt/sophos-av/bin/savconfig get TalpaOperations (check disabled mode) cat /proc/sys/talpa/intercept-filters/VettingController/ops (check all modes) /opt/sophos-av/bin/savconfig set TalpaOperations -- -open (set mode to disabled for open/read) /opt/sophos-av/bin/savconfig get TalpaOperations cat /proc/sys/talpa/intercept-filters/VettingController/ops -open +close +exec +mount +umount /opt/sophos-av/bin/savconfig query NamedScans (Check Scheduled Scans) /opt/sophos-av/bin/savconfig query NamedScans SEC:FullSystemScan (Check Scheduled Scans with argument) /opt/sophos-av/bin/savconfig add ExcludeFilePaths /home/user1/ (ADD Exclude files' path) /opt/sophos-av/bin/savconfig remove ExcludeFilePaths /home/user1/ (REMOVE Exclude files' path) # Check Global exclusions /opt/sophos-av/bin/savconfig query ExcludeFileOnGlob && /opt/sophos-av/bin/savconfig query ExcludeFilePaths /opt/sophos-av/bin/savdctl disable (disable on-access scanning) /opt/sophos-av/bin/savdstatus (check) Sophos Anti-Virus is active but on-access scanning is not running To get ON-Access Scanning back, restart all Sophos related services: for i in `chkconfig --list |grep sav |awk '{print $1}'`;do echo -e "\n\e[93mShow service $i restart \e[0m\n";service $i restart;done |
Scan
|
1 2 3 4 5 6 7 |
>> Perform the scan -> this will create a log savscan -nc -f -s --no-follow-symlinks --backtrack-protection --quarantine <path/to/scan> (manual scan) >> Than, check the log to see what it has been found from the manual scan /opt/sophos-av/bin/savlog --today --utc | grep detected (check threats for today -) grep INFECTED /opt/sophos-av/log/savd.log | grep -P -o '(?<=arg>)/[^<]*(?=</arg)' | sort -u (check all threats) savscan --help |
Example for multiple folders with final report:
(suggested to run in a screen session)
- Create a temporary folder:
1mkdir -p /tmp/scantmp/ > && cd $_ - list all directories that you want to scan (full path) into a file called list_folder.txt within the temp folder;
- Run the following:
12for i in `cat list_folder.txt` ; do nice / renice -n 19 savscan -nc -f -s --no-follow-symlinks --backtrack-protection --quarantine $i 2>&1 >> scan.log ; done/opt/sophos-av/bin/savlog --today --utc | grep "Threat detected" | awk -F" " '{print $2}' > report.txt - Check report.txt