0

ClamAV shows me 3 infected files. I ran clamscan -r, which showed 3 infected files. Next I ran clamscan -v, which showed these files:

/initrd.img: Symbolic link
/initrd.img.old: Symbolic link
/vmlinuz: Symbolic link

I have no clue what these 3 files are and if they're even viruses or not. I did some searching on google, but only found out that these files have something to do with networking and (or) kernel updates. Also, I read that these files regenerate in the system. Grateful if anyone can help me clean these files.

During scan I did not have any mounted external drives. My system dual booted with windows 8.1 with Ubuntu as the primary boot partition, so unless I don't select Windows in the grub, the system automatically takes me to Ubuntu.

The scan output:

kabir@kabirG50-80:~$ clamscan -v /
/initrd.img: Symbolic link
/initrd.img.old: Symbolic link
/vmlinuz: Symbolic link

----------- SCAN SUMMARY -----------
Known viruses: 3930644
Engine version: 0.98.7
Scanned directories: 1
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 7.834 sec (0 m 7 s)
kabir@kabirG50-80:~$ 

clamscan -r / shows
Infected files : 3

/bin/ntfscmp: OK
/bin/more: OK
/bin/busybox: OK
/bin/zcat: OK
/bin/zcmp: OK
/bin/bzip2recover: OK
/bin/gzip: OK
/bin/dnsdomainname: Symbolic link
/bin/rbash: Symbolic link

----------- SCAN SUMMARY -----------
Known viruses: 3930644
Engine version: 0.98.7
Scanned directories: 28035
Scanned files: 121737
Infected files: 3
Total errors: 20849
Data scanned: 3720.71 MB
Data read: 8006.27 MB (ratio 0.46:1)
Time: 635.037 sec (10 m 35 s)
kabir@kabirG50-80:~$ 
10
  • can you add the full output from clamscan please. You should not have a /vmlinuz ;)
    – Panther
    Aug 9, 2015 at 21:31
  • Those files are large binary files: ClamAV is probably looking for a known binary signature and has found it in those files. Unless you have more information, I wouldn't be troubled. It is probably just a coincidence that the signature is found in those large files. Don't try to "clean" those files as they are essential to your system.
    – Jos
    Aug 9, 2015 at 21:32
  • @bodhi.zazen I have a /vmlinuz which is a symbolic link to /boot/vmlinuz on both my Ubuntu systems.
    – Jos
    Aug 9, 2015 at 21:34
  • clamscan does not identify any of my vmlinux* files as infected. Without additional information it is impossible to give good advice, I would not ignore it without further investigation
    – Panther
    Aug 9, 2015 at 21:37
  • kabir@kabirG50-80:~$ clamscan -v / /initrd.img: Symbolic link /initrd.img.old: Symbolic link /vmlinuz: Symbolic link ----------- SCAN SUMMARY ----------- Known viruses: 3930644 Engine version: 0.98.7 Scanned directories: 1 Scanned files: 0 Infected files: 0 Data scanned: 0.00 MB Data read: 0.00 MB (ratio 0.00:1) Time: 7.834 sec (0 m 7 s) kabir@kabirG50-80:~$
    – K.Gandhiok
    Aug 9, 2015 at 21:39

1 Answer 1

0

You run clamscan in verbose mode. That causes it to warn you that there are three symbolic links in your root directory, just that. It doesn't actually say that these files are infected. In fact a symbolic link is just a small entry in the file table; it can't contain a virus, but the file that the link points to could contain one. To see that they aren't in fact infected, run clamscan on the files itself.

ls -l /

will show a list of directories, as well as three symbolic links: initrd.img, initrd.img.old, and vmlinuz. These point to three large files in /boot. If you run

sudo clamscan -v /boot/initrd.img-[VERSION_ID]

(change VERSION_ID to whatever you have there) you will see that the file is not actually infected.

jos@zyrrup:/boot$ sudo clamscan -v initrd.img-3.19.0-25-generic 
[sudo] password for jos: 
Scanning initrd.img-3.19.0-25-generic
initrd.img-3.19.0-25-generic: OK

----------- SCAN SUMMARY -----------
Known viruses: 3930644
Engine version: 0.98.7
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 20.05 MB
Data read: 19.86 MB (ratio 1.01:1)
Time: 18.721 sec (0 m 18 s)

Repeat for the other two files.

5
  • Thanks, I ran the scans and initrd.img came out clean but when I tried to scan initrd.img.old and vmlinuz I got a warning saying "no such file or directory exists, can't access file" I tried running the commands from outside /boot as well and still got the same warning.
    – K.Gandhiok
    Aug 9, 2015 at 22:47
  • Correction: vmlinuz and initrd.img both got scanned and came out OK. File /initrd.img.old gives the does not exist warning when I try to scan it. Sorry for not correcting my comment earlier.
    – K.Gandhiok
    Aug 9, 2015 at 22:57
  • Any idea why I get "no such file or directory exists, can't access file" when I try to scan /initrd.img.old. Could it be because it's an old kernel file, which has been updated to /initrd.img?
    – K.Gandhiok
    Aug 10, 2015 at 8:00
  • Possibly the link /initrd.img.old exists but not the file that it points to. That should be easy to check. If it doesn't, it is safe to do sudo rm /initrd.img.old.
    – Jos
    Aug 10, 2015 at 8:05
  • thanks for that and helping me out :-) I ran clamscan -r --bell -i / which showed me my 3 infected files are in fact 3 suspicious emails on thunderbird.
    – K.Gandhiok
    Aug 10, 2015 at 8:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .