Difference between revisions of "ClamAV"

Revision as of 13:02, 14 June 2012

To disinfect a Windows PC by running ClamAV from an Ubuntu liveCD:

Boot the liveCD
Install the "clamav" package
Mount the infected drive (opening it from "Locations" will do)
run df to find out the drive's filesystem path. We'll assume it's /media/disk.
Run clamscan in read-only mode to see if there are any detectable infections:
- clamscan -v -r /media/disk
To move infected files into a quarantine area (only partially tested):
- sudo clamscan -v -r --move=/media/disk/quarantine /media/disk
- real-world example:
  - sudo clamscan -v -r --move=/media/IBM_PRELOAD/etc/quarantine /media/IBM_PRELOAD
to be written: what to do if infections are found.
- Basically, you'll probably want to set up a folder for quarantining infected files, and then run clamscan with the option to move infected files there.
If no infections found, you may still be able to find infections with one of the Windows versions; there may be a way to force the Linux version to use the very latest data engine, but I'm not sure.

In Microsoft Windows, ClamAV is available in two varieties:

Failed to install runtime with error code 1601 - ClamAV for Windows can't be installed in "safe mode", despite the obvious advantage of being able to do this with an anti-virus program.

@@ Line 10: / Line 10: @@
 * Run clamscan in read-only mode to see if there are any detectable infections:
 ** clamscan -v -r /media/disk
+* To move infected files into a quarantine area (only partially tested):
+** sudo clamscan -v -r --move=/media/disk/quarantine /media/disk
+** real-world example:
+*** sudo clamscan -v -r --move=/media/IBM_PRELOAD/etc/quarantine /media/IBM_PRELOAD
 * ''to be written: what to do if infections are found.''
 ** Basically, you'll probably want to set up a folder for quarantining infected files, and then run clamscan with the option to move infected files there.