Linux Antivirus

[tech4rce]

Hi, I need your help. I'm trying to locate an Anti-Virus program that would be installed on a Linux box (Redhat 9) but would also be able to scan "windows" hard drives (slaves).

I've tries this set up with some programs but they were not able to locate any infected files on the "windows" hard drive. But when I scan these hard drives with a Windows box, I had over 900 infected files (this was a test machine so it's ok).

Any help would be greatly appreciated.

Thanks

Dan

 

[BitFuzzy]

I know this has been covered plenty of times.

ClamAV --

http://www.clamav.net

MailScanner --

http://www.sng.ecs.soton.ac.uk/mailscanner/

 

[tech4rce]

Hi BitFuzzy, believe it or not but I was using "clamAV" and it still didn't find any of the infected files on the windows hard drive.

Dan

 

[thedaver]

Uh, that's interesting. ClamAV is really quite good.
How did you execute clamav against a partition and how did you determine that it didn't work?

Surfinbox.com Business Internet Services - National Dialup, DSL, T-1 and more.

http://www.surfinbox.com/business/

 

[tech4rce]

Hi thedaver, I infected the "test" machine (windows 98)with a virus (one that I received through an e-mail).

Attached the infected Hard drive to Linux box (mount /dev/hdb1 /mnt/hdb1), at the command prompt ran clamscan /mnt/hdb1. Oh before this I also ran "freshclam" to get the latest updates. It did scan the hard drive but said that there wasn't any thing wrong. Go figure.

Know I know that it was infected because I also ran the Hard drive on a Windows box (XP with Norton)- came up with over 900 files infected.

I have to screen shot of the results as proof. Also the infected box could not "see" a second drive or NIC and it was acting "funny". Had to clear the CMOS also.

Mayby I was doing something wrong?? Let me know please.

Dan

 

[thedaver]

Were the infected files in zipped format? I don't recall if clamav has native unzip/untar/ungzip enabled/available. Might explain some misses.

Surfinbox.com Business Internet Services - National Dialup, DSL, T-1 and more.

http://www.surfinbox.com/business/

 

[tech4rce]

Hi thedaver,
no these infected files were not in "zip" format. There must be (I would think) a setting that would scan "all" files somewhere (I could not find it)?

Just out of curiousity, how do you use the clamAV scanner?

 

[thedaver]

I use clamav as part of a qmail MTA install running under qmail-queue... I don't routinely use it to scan for file virii.

Surfinbox.com Business Internet Services - National Dialup, DSL, T-1 and more.

http://www.surfinbox.com/business/

 

[dsryan]

G'day guys,
did you try clamscan -r /mnt/hdb1?

The -r is for recursive scanning i.e. drills down all directories (folders for windog users). As it happens I am scanning my windog partition as I type.

Hope this helps, Dave.

 

[tech4rce]

Hi dsryan, no I haven't tried that way, but I will.

Thanks.