Ubuntu – How to scan for viruses with ClamAV

antivirusclamavmalwareSecurity

I installed ClamAV via Terminal (Ctrl+Alt+T) with:

sudo apt-get install clamav

but how can I scan for viruses?

Best Answer

Terminal

At first you have to update the virus definitions with:

sudo freshclam

Then you can scan for viruses.

clamscan OPTIONS File/Folder

If necessary start with root permissions: sudo clamscan.

Examples:

To check all files on the computer, displaying the name of each file:
```
clamscan -r /
```
To check all files on the computer, but only display infected files and ring a bell when found:
```
clamscan -r --bell -i /
```
To scan all files on the computer but only display infected files when found and have this run in the background:
```
clamscan -r -i / &
```
Note - Display background process's status by running the jobs command.
To check files in the all users home directories:
```
clamscan -r /home
```
To check files in the USER home directory and move infected files to another folder:
```
clamscan -r --move=/home/USER/VIRUS /home/USER
```
To check files in the USER home directory and remove infected files (WARNING: Files are gone.):
```
clamscan -r --remove /home/USER
```
To see more options:
```
clamscan --help
```

See:

Latest documentation: PDF | HTML
ClamAV official Wiki
Ubuntu Wiki

Graphical User Interface: ClamTK

ClamTk is a frontend for ClamAV. You can install it via Terminal with:

sudo apt-get install clamtk

You can get the latest version from Bitbucket as Debian package.

There is also a PPA (Outdated):

sudo apt-add-repository ppa:landronimirc/clamtk
sudo apt-get update && sudo apt-get install clamtk

clamtk screenshot

Scan Menu: Here you can choose a file, folder or a device for scanning

clamtk scan menu screenshot

View Menu:

clamtk view menu screenshot

Quarantine Menu:

clamtk quarantine menu screenshot

Advanced Menu:

clamtk advanced menu screenshot

Help Menu: Here you can check for updates.

clamtk help menu screenshot

See:

ClamTk@Sourceforge
ClamTk Help
ClamTk FAQ

Related Solutions

Ubuntu – ClamAV detects certain files on the PlayOnLinux directory as malware, should I be concerned

True, "Linux is virus free" is a myth. And it's also an extremely inaccurate and vague sentence.

You can read a lot on this topic, and there are a lot of articles explaining you what kind of "virus" (believe me, it's the wrong word to define such things, but let's use it for this discussion) are out there, how a "virus" may harm you, and how unlikely this event can be on a desktop system.

To start I suggest you to read Is Linux Immune to Viruses?

Actually if you:

use a recent release of Ubuntu that's currently supported
install only packages from main repositories and Ubuntu Software Center
set a complex user password
keep your system constantly updated
setup ufw firewall

the odds that you get any harm from a "virus" or "malware" are extremely low, approaching zero.

The best thing you can do to protect yourself from potentially harmful "viruses" is to read and learn about system inner workings and security. No software can be as effective as "security device" as knowledge. ;-)

About your experiences: since PlayOnLinux uses Wine to make Windows software run on GNU/Linux, you are able to run most of the software that can run on Microsoft Windows, even viruses. Actually they are a lot less harmful on Ubuntu than on Windows, since Wine isolate them from most of the system, but still they can do something.

What ClamAV found were the exactly the same Windows viruses you could get on Windows. Maybe you got them trying to install something from untrustworthy sources, that you ought to avoid anyway.

So, in conclusion, it's practically true that "Linux is virus free", as long as you stick on the 5 points above. ;-)

Ubuntu – How to schedule ClamAv to perform a daily scan

I would use cron for this instead of strictly using bash. In the directory /etc/cron.daily/ create a small script clamavscan.sh that looks like:

#!/bin/sh
clamscan /home/username/

Then be sure to make the script executable with chmod +x clamavscan.sh. This should run the clamscan of your home directory once daily at 6:25 (as you can see in the file /etc/crontab).

To have ClamAV scan you entire machine, you should just be able to run clamscan /, although this might require root privileges to really scan everything.