0

ClamAV shows me 3 infected files. I ran clamscan -r, which showed 3 infected files. Next I ran clamscan -v, which showed these files:

/initrd.img: Symbolic link
/initrd.img.old: Symbolic link
/vmlinuz: Symbolic link

I have no clue what these 3 files are and if they're even viruses or not. I did some searching on google, but only found out that these files have something to do with networking and (or) kernel updates. Also, I read that these files regenerate in the system. Grateful if anyone can help me clean these files.

During scan I did not have any mounted external drives. My system dual booted with windows 8.1 with Ubuntu as the primary boot partition, so unless I don't select Windows in the grub, the system automatically takes me to Ubuntu.

The scan output:

kabir@kabirG50-80:~$ clamscan -v /
/initrd.img: Symbolic link
/initrd.img.old: Symbolic link
/vmlinuz: Symbolic link

----------- SCAN SUMMARY -----------
Known viruses: 3930644
Engine version: 0.98.7
Scanned directories: 1
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 7.834 sec (0 m 7 s)
kabir@kabirG50-80:~$ 

clamscan -r / shows
Infected files : 3

/bin/ntfscmp: OK
/bin/more: OK
/bin/busybox: OK
/bin/zcat: OK
/bin/zcmp: OK
/bin/bzip2recover: OK
/bin/gzip: OK
/bin/dnsdomainname: Symbolic link
/bin/rbash: Symbolic link

----------- SCAN SUMMARY -----------
Known viruses: 3930644
Engine version: 0.98.7
Scanned directories: 28035
Scanned files: 121737
Infected files: 3
Total errors: 20849
Data scanned: 3720.71 MB
Data read: 8006.27 MB (ratio 0.46:1)
Time: 635.037 sec (10 m 35 s)
kabir@kabirG50-80:~$ 
  • can you add the full output from clamscan please. You should not have a /vmlinuz ;) – Panther Aug 9 '15 at 21:31
  • Those files are large binary files: ClamAV is probably looking for a known binary signature and has found it in those files. Unless you have more information, I wouldn't be troubled. It is probably just a coincidence that the signature is found in those large files. Don't try to "clean" those files as they are essential to your system. – Jos Aug 9 '15 at 21:32
  • @bodhi.zazen I have a /vmlinuz which is a symbolic link to /boot/vmlinuz on both my Ubuntu systems. – Jos Aug 9 '15 at 21:34
  • clamscan does not identify any of my vmlinux* files as infected. Without additional information it is impossible to give good advice, I would not ignore it without further investigation – Panther Aug 9 '15 at 21:37
  • kabir@kabirG50-80:~$ clamscan -v / /initrd.img: Symbolic link /initrd.img.old: Symbolic link /vmlinuz: Symbolic link ----------- SCAN SUMMARY ----------- Known viruses: 3930644 Engine version: 0.98.7 Scanned directories: 1 Scanned files: 0 Infected files: 0 Data scanned: 0.00 MB Data read: 0.00 MB (ratio 0.00:1) Time: 7.834 sec (0 m 7 s) kabir@kabirG50-80:~$ – K.Gandhiok Aug 9 '15 at 21:39
0

You run clamscan in verbose mode. That causes it to warn you that there are three symbolic links in your root directory, just that. It doesn't actually say that these files are infected. In fact a symbolic link is just a small entry in the file table; it can't contain a virus, but the file that the link points to could contain one. To see that they aren't in fact infected, run clamscan on the files itself.

ls -l /

will show a list of directories, as well as three symbolic links: initrd.img, initrd.img.old, and vmlinuz. These point to three large files in /boot. If you run

sudo clamscan -v /boot/initrd.img-[VERSION_ID]

(change VERSION_ID to whatever you have there) you will see that the file is not actually infected.

jos@zyrrup:/boot$ sudo clamscan -v initrd.img-3.19.0-25-generic 
[sudo] password for jos: 
Scanning initrd.img-3.19.0-25-generic
initrd.img-3.19.0-25-generic: OK

----------- SCAN SUMMARY -----------
Known viruses: 3930644
Engine version: 0.98.7
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 20.05 MB
Data read: 19.86 MB (ratio 1.01:1)
Time: 18.721 sec (0 m 18 s)

Repeat for the other two files.

  • Thanks, I ran the scans and initrd.img came out clean but when I tried to scan initrd.img.old and vmlinuz I got a warning saying "no such file or directory exists, can't access file" I tried running the commands from outside /boot as well and still got the same warning. – K.Gandhiok Aug 9 '15 at 22:47
  • Correction: vmlinuz and initrd.img both got scanned and came out OK. File /initrd.img.old gives the does not exist warning when I try to scan it. Sorry for not correcting my comment earlier. – K.Gandhiok Aug 9 '15 at 22:57
  • Any idea why I get "no such file or directory exists, can't access file" when I try to scan /initrd.img.old. Could it be because it's an old kernel file, which has been updated to /initrd.img? – K.Gandhiok Aug 10 '15 at 8:00
  • Possibly the link /initrd.img.old exists but not the file that it points to. That should be easy to check. If it doesn't, it is safe to do sudo rm /initrd.img.old. – Jos Aug 10 '15 at 8:05
  • thanks for that and helping me out :-) I ran clamscan -r --bell -i / which showed me my 3 infected files are in fact 3 suspicious emails on thunderbird. – K.Gandhiok Aug 10 '15 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.