4

I scanned my computer for viruses by using clamav: sudo clamscan -r --bell -i /. I received the following result:

LibClamAV Warning: cli_scanxz: decompress file size exceeds limits - only scanning 27262976 bytes

LibClamAV Warning: cli_scanxz: decompress file size exceeds limits - only scanning 27262976 bytes

LibClamAV Warning: cli_scanxz: decompress file size exceeds limits - only scanning 27262976 bytes

/home/beck/Documents/from flash/unsorted/autorun.inf: INF.Autorun.Gen FOUND

LibClamAV Warning: fmap_readpage: pread fail: asked for 4077 bytes @ offset 19, got 0

WARNING: Can't open file /sys/module/ipt_REJECT/uevent: Permission denied

LibClamAV Warning: fmap_readpage: pread fail: asked for 4077 bytes @ offset 19, got 0

LibClamAV Warning: fmap_readpage: pread fail: asked for 4093 bytes @ offset 3, got 0

LibClamAV Warning: fmap_readpage: pread fail: asked for 4094 bytes @ offset 2, got 0

WARNING: Can't open file /sys/module/nf_conntrack_tftp/uevent: Permission denied

LibClamAV Warning: fmap_readpage: pread fail: asked for 4094 bytes @ offset 2, got 0

----------- SCAN SUMMARY -----------
Known viruses: 3775271 Engine version: 0.98.6 Scanned directories: 98517 Scanned files: 1144928 Infected files: 2 Total errors: 19018 Data scanned: 51350.64 MB Data read: 69028.91 MB (ratio 0.74:1) Time: 10960.993 sec (182 m 40 s)

I succeeded deleting the "autorun" virus. But I cannot find the other virus. So, what should I do with the infected file and the errors?

1 Answer 1

4

For the

decompress file size exceeds limits

Please try using the following option for clamscan, (many) virus scanners do not scan a file if they exceed a certain size.

--max-filesize=(size/MB/GB)

You may pass the value in megabytes in format xM or xm, where x is a number.

eg: --max-filesize=50M

The default size is 25MB.

Source: http://lurker.clamav.net/message/20140926.143835.3e73415e.nl.html

(man page) More info @: http://linux.die.net/man/1/clamscan

In some cases you might need the --max-scansize also.

--max-filesize=#n
    Extract and scan at most #n kilobytes from each archive. You may pass the value in megabytes in format xM or xm, where x is a number. This option protects your system against DoS attacks (default: 25 MB, max: <4 GB) 
--max-scansize=#n
    Extract and scan at most #n kilobytes from each scanned file. You may pass the value in megabytes in format xM or xm, where x is a number. This option protects your system against DoS attacks (default: 100 MB, max: <4 GB) 

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .