From cf11b95c3f62ec36b87ee194f31cf0b43e53b39b Mon Sep 17 00:00:00 2001
From: mboelen <michael@cisofy.com>
Date: Mon, 28 Sep 2015 11:00:34 +0200
Subject: [PATCH] Added detection of ESET products and logging of malware
 scanner to report

---
 include/tests_malware | 40 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 37 insertions(+), 3 deletions(-)

diff --git a/include/tests_malware b/include/tests_malware
index 5903826b..b9d4c0e8 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -23,6 +23,9 @@
 #################################################################################
 #
     CLAMD_RUNNING=0
+    CLAMSCAN_INSTALLED=0
+    ESET_DAEMON_RUNNING=0
+    FRESHCLAM_DAEMON_RUNNING=0
     MCAFEE_SCANNER_RUNNING=0
     MALWARE_SCANNER_INSTALLED=0
     SOPHOS_SCANNER_RUNNING=0
@@ -39,6 +42,7 @@
             logtext "Result: Found ${CHKROOTKITBINARY}"
             MALWARE_SCANNER_INSTALLED=1
             AddHP 2 2
+            report "malware_scanner[]=chkrootkit"
           else
             logtext "Result: chkrootkit not found"
         fi
@@ -56,6 +60,7 @@
             logtext "Result: Found ${RKHUNTERBINARY}"
             MALWARE_SCANNER_INSTALLED=1
             AddHP 2 2
+            report "malware_scanner[]=rkhunter"
           else
             logtext "Result: Rootkit Hunter not found"
         fi
@@ -73,6 +78,7 @@
             logtext "Result: Found ${LMDBINARY}"
             MALWARE_SCANNER_INSTALLED=1
             AddHP 2 2
+            report "malware_scanner[]=lmd"
           else
             logtext "Result: LMD not found"
         fi
@@ -85,6 +91,21 @@
     Register --test-no MALW-3280 --weight L --network NO --description "Check if anti-virus tool is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
+
+        # ESET security products
+        logtext "Test: checking process esets_daemon"
+        IsRunning esets_daemon
+        if [ ${RUNNING} -eq 1 ]; then
+            FOUND=1
+            Display --indent 2 --text "- Checking ESET daemon" --result "FOUND" --color GREEN
+            logtext "Result: found ESET security product"
+            ESET_DAEMON_RUNNING=1
+            MALWARE_SCANNER_INSTALLED=1
+            AddHP 2 2
+            report "malware_scanner[]=eset"
+        fi
+
+        # McAfee products
         logtext "Test: checking process cma or cmdagent (McAfee)"
         # cma is too generic to match on, so we want to ensure that it is related to McAfee first
         if [ -x /opt/McAfee/cma/bin/cma ]; then
@@ -100,28 +121,31 @@
             logtext "Result: Found McAfee"
             MALWARE_SCANNER_INSTALLED=1
             AddHP 2 2
+            report "malware_scanner[]=mcafee"
+
         fi
         # Sophos savscand/SophosScanD
         logtext "Test: checking process savscand"
         IsRunning savscand
         if [ ${RUNNING} -eq 1 ]; then
             FOUND=1
-            SOPHOS_SCANNER_RUNNING=1;
+            SOPHOS_SCANNER_RUNNING=1
         fi
         logtext "Test: checking process SophosScanD"
         IsRunning SophosScanD
         if [ ${RUNNING} -eq 1 ]; then
             FOUND=1
-            SOPHOS_SCANNER_RUNNING=1;
+            SOPHOS_SCANNER_RUNNING=1
         fi
         if [ ${SOPHOS_SCANNER_RUNNING} -eq 1 ]; then
             Display --indent 2 --text "- Checking Sophos" --result "FOUND" --color GREEN
             logtext "Result: Found Sophos"
             MALWARE_SCANNER_INSTALLED=1
             AddHP 2 2
+            report "malware_scanner[]=sophos"
         fi
         if [ ${FOUND} -eq 0 ]; then
-            logtext "Result: no commercial anti-virus tool found"
+            logtext "Result: no commercial anti-virus tools found"
             AddHP 0 3
         fi
     fi
@@ -137,6 +161,7 @@
             Display --indent 2 --text "- Checking ClamAV scanner" --result "FOUND" --color GREEN
             logtext "Result: Found ${CLAMSCANBINARY}"
             MALWARE_SCANNER_INSTALLED=1
+            CLAMSCAN_INSTALLED=1
             AddHP 2 2
           else
             logtext "Result: clamscan couldn't be found"
@@ -171,6 +196,7 @@
         logtext "Test: checking running freshclam daemon"
         IsRunning freshclam
         if [ ${RUNNING} -eq 1 ]; then
+            FRESHCLAM_DAEMON_RUNNING=1
             Display --indent 4 --text "- Checking freshclam" --result "FOUND" --color GREEN
             logtext "Result: found running freshclam process"
             AddHP 2 2
@@ -193,6 +219,7 @@
             logtext "Result: Found ClamXav clamscan installed"
             Display --indent 2 --text "- Checking presence of ClamXav AV scanner" --result "FOUND" --color GREEN
             MALWARE_SCANNER_INSTALLED=1
+            CLAMSCAN_INSTALLED=1
             AddHP 3 3
           else
             logtext "Result: ClamXav malware scanner not found"
@@ -201,6 +228,13 @@
     fi
 #
 #################################################################################
+#
+    # Check if we found any of the ClamAV components
+    if [ ${CLAMSCAN_INSTALLED} -eq 1 -o ${CLAMD_RUNNING} -eq 1 -o ${FRESHCLAM_DAEMON_RUNNING} -eq 1 ]; then
+        report "malware_scanner[]=clamav"
+    fi
+#
+#################################################################################
 #
 
 report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}"