5

I am using ClamAV to scan for viruses on my machine (Ubuntu 19.10). Are there specific folders that I should scan or should I pretty much scan everything under /?

6

Files to scan are:

  • Files on a NTFS partition
  • Files transported to Windows machines (ie. when your Ubuntu is acting as a gateway and services your Windows machines in your network).

If you plan to scan Linux systems: viruscanners use windows definitions to scan files so it is a pretty close to useless activity on Linux systems.

Personal observation: As of today I have yet to encounter a virus on any of the Linux (that would be Ubuntu, Debian, SUSE and Fedora) and Unix (that would be SCO, HP-UX, and AIX) systems I maintain for the past 25 years. I did see plenty of Windows virusses on Windows machines.

It is far better to secure your systems with a GOOD admin password and train users of those systems to not provide their user password when it is asked and not expected. And for the admin to ONLY install software from reliable sources. At the moment the only way to get a virus is when you install it yourself. So make sure you do not. And next to that: always make backups. Make sure those are disconnected from your system and preferably stored elsewhere (as in miles/kilometers; not in a nearby cabinet).

The thing to watch out for on Linux systems is something else, namely rootkits. The tool to use would be Lynis, Chkrootkit, and/or Rkhunter. But if you ever find one of those it is best to start from scratch: purge the system and restore a backup you can verify is untouched and then fix the issue it was caused by.

  • Thanks a lot for the detailed answer. I had heard that although a windows virus may not impact Linux, but it might move from Linux to another machine. This is why you recommend "Files transported to Windows machines", right? Should I also scan /home in case someone has downloaded something harmful? – SaTa Feb 1 at 1:28
  • Also, I did use to scan /home and once ClamAV marked an email downloaded by Evolution as suspicious because a link within the email had a domain other than the senders domain. Is this valid? If yes, is this another use for ClamAV in Linux? – SaTa Feb 1 at 1:30
4

I do not think that this is necessary at all, but in case that this is your personal workstation, scanning everything in your home directory every once in a while should be enough. Assuming, you only install packages from trusted sources via apt, of course.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.