1

How can I get the file path of the returned infected files list from a clamscan -ri?

right now I am seeing this:

/home/folder/public_html/wp-content/uploads/2015/07/HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt: Doc.Exploit.CVE_2015_2341 FOUND
/home/folder/public_html/wp-content/uploads/2015/07/HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt: copied to '/folder/infections//HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt'
/home/folder/public_html/wp-content/uploads/2015/02/Tech003_HA_HYAFF_technology_MASTER_presentation_RevB.ppt: Doc.Exploit.CVE_2015_2341 FOUND
/home/folder/public_html/wp-content/uploads/2015/02/Tech003_HA_HYAFF_technology_MASTER_presentation_RevB.ppt: copied to '/folder/infections//Tech003_HA_HYAFF_technology_MASTER_presentation_RevB.ppt'
/home/folder/public_html/wp-content/uploads/2015/02/HM006_Hyalomatrix_PA_product_overview_training_RevB.ppt: Doc.Exploit.CVE_2015_2341 FOUND
/home/folder/public_html/wp-content/uploads/2015/02/HM006_Hyalomatrix_PA_product_overview_training_RevB.ppt: copied to '/folder/infections//HM006_Hyalomatrix_PA_product_overview_training_RevB.ppt'
/home/folder/public_html/wp-content/uploads/2014/10/HG010_Hyaloglide_product_overview_training_RevC.ppt: Doc.Exploit.CVE_2015_2341 FOUND
/home/folder/public_html/wp-content/uploads/2014/10/HG010_Hyaloglide_product_overview_training_RevC.ppt: copied to '/folder/infections//HG010_Hyaloglide_product_overview_training_RevC.ppt'

what I'd like is the file path only. for instance /home/folder/public_html/wp-content/uploads/2015/07/HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt

Maybe a simple sed command to grab everything before the :? I don't know the pattern I should use tho

1

Another solution using awk + readarray;

To process the output of clamscan -ri:

clamscan -ri | awk -F ':' '/FOUND/ {print $1}'
  • -F ':': sets awk's field separator to :;
  • /FOUND/: pattern; executes the following action only if the record matches the FOUND string;
  • {print $1}: prints the first field;

To read the processed output of clamscan -ti into an array $x:

mapfile -t x < <(clamscan -ri | awk -F ':' '/FOUND/ {print $1}')
  • -t: removes the trailing newline at the end of each line before reading it into the array;
  • < <(clamscan -ri | awk -F ':' '/FOUND/ {print $1}'): redirects the output of the process substitution <(clamscan -ri | awk -F ':' '/FOUND/ {print $1}') to readarray's stdin
ubuntu@ubuntu:~/tmp$ cat infile
/home/folder/public_html/wp-content/uploads/2015/07/HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt: Doc.Exploit.CVE_2015_2341 FOUND
/home/folder/public_html/wp-content/uploads/2015/07/HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt: copied to '/folder/infections//HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt'
/home/folder/public_html/wp-content/uploads/2015/02/Tech003_HA_HYAFF_technology_MASTER_presentation_RevB.ppt: Doc.Exploit.CVE_2015_2341 FOUND
/home/folder/public_html/wp-content/uploads/2015/02/Tech003_HA_HYAFF_technology_MASTER_presentation_RevB.ppt: copied to '/folder/infections//Tech003_HA_HYAFF_technology_MASTER_presentation_RevB.ppt'
/home/folder/public_html/wp-content/uploads/2015/02/HM006_Hyalomatrix_PA_product_overview_training_RevB.ppt: Doc.Exploit.CVE_2015_2341 FOUND
/home/folder/public_html/wp-content/uploads/2015/02/HM006_Hyalomatrix_PA_product_overview_training_RevB.ppt: copied to '/folder/infections//HM006_Hyalomatrix_PA_product_overview_training_RevB.ppt'
/home/folder/public_html/wp-content/uploads/2014/10/HG010_Hyaloglide_product_overview_training_RevC.ppt: Doc.Exploit.CVE_2015_2341 FOUND
/home/folder/public_html/wp-content/uploads/2014/10/HG010_Hyaloglide_product_overview_training_RevC.ppt: copied to '/folder/infections//HG010_Hyaloglide_product_overview_training_RevC.ppt'
ubuntu@ubuntu:~/tmp$ cat infile | awk -F ':' '/FOUND/ {print $1}'
/home/folder/public_html/wp-content/uploads/2015/07/HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt
/home/folder/public_html/wp-content/uploads/2015/02/Tech003_HA_HYAFF_technology_MASTER_presentation_RevB.ppt
/home/folder/public_html/wp-content/uploads/2015/02/HM006_Hyalomatrix_PA_product_overview_training_RevB.ppt
/home/folder/public_html/wp-content/uploads/2014/10/HG010_Hyaloglide_product_overview_training_RevC.ppt
ubuntu@ubuntu:~/tmp$ mapfile -t x < <(awk -F ':' '/FOUND/ {print $1}' infile)
ubuntu@ubuntu:~/tmp$ echo "${x[@]}"
/home/folder/public_html/wp-content/uploads/2015/07/HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt /home/folder/public_html/wp-content/uploads/2015/02/Tech003_HA_HYAFF_technology_MASTER_presentation_RevB.ppt /home/folder/public_html/wp-content/uploads/2015/02/HM006_Hyalomatrix_PA_product_overview_training_RevB.ppt /home/folder/public_html/wp-content/uploads/2014/10/HG010_Hyaloglide_product_overview_training_RevC.ppt
3
  • Tried cl_scan=$(clamscan -ri | awk -F ':' '/FOUND/ {print $1}') for f in "${cl_scan[@]}" do echo $f done to no avail, also tried the mapfile – Kevin Sep 10 '15 at 21:19
  • @Kevin Did you copy paste the command? If you did then the command should have rather been cl_scan=$(clamscan -ri | awk -F ':' '/FOUND/ {print $1}'); for f in "${cl_scan[@]}"; do echo "$f"; done. if this doesn't work please add the full output of clamscan -ri to your question – kos Sep 10 '15 at 21:26
  • yea, it was just missing the path to scan. thanks – Kevin Sep 10 '15 at 21:46
2
$ clamscan -ri | sed -n '/FOUND/s/: .*//p'
/home/folder/public_html/wp-content/uploads/2015/07/HB006_Hyalobarrier-Product-training-MASTER-10-07-15.ppt
/home/folder/public_html/wp-content/uploads/2015/02/Tech003_HA_HYAFF_technology_MASTER_presentation_RevB.ppt
/home/folder/public_html/wp-content/uploads/2015/02/HM006_Hyalomatrix_PA_product_overview_training_RevB.ppt
/home/folder/public_html/wp-content/uploads/2014/10/HG010_Hyaloglide_product_overview_training_RevC.ppt

How it works

Each file appears on two lines of the input. To avoid duplicates, we need to select just one of those lines. This code selects the first appearance, the one with the word FOUND at the end of the line. It then removes everything after the : and prints the line.

In more detail:

  • -n

    This tells sed not to print anything unless we explicitly ask it to.

  • /FOUND/ s/: .*//p

    This selects the lines that contain the word FOUND. The substitute command, s/: .*//, removes everything after the colon-space. The suffix p tells sed to print these lines.

Making the output into a bash array

To make a bash array of the file names:

IFS=$'\n' cl_scan=($(clamscan -ri | sed -n '/FOUND/s/: .*//p'))

Because we set IFS=$'\n', this will work even for file names that contain spaces or tabs. This will not work for file names that contain newlines or colon-space.

To verify that the array is as desired, run:

$ declare -p cl_scan
declare -a cl_scan='([0]="/home/folder/public html/wp content/uploads/2015/07/HB006 Hyalobarrier Product training MASTER 10 07 15.ppt" [1]="/home/folder/public html/wp content/uploads/2015/02/Tech003 HA HYAFF technology MASTER presentation RevB.ppt" [2]="/home/folder/public html/wp content/uploads/2015/02/HM006 Hyalomatrix PA product overview training RevB.ppt" [3]="/home/folder/public html/wp content/uploads/2014/10/HG010 Hyaloglide product overview training RevC.ppt")'
6
  • so, cl_scan=$(clamscan -ri /home/*/public_html | sed -n '/FOUND/s/: .*//p'); would be an array of the paths? I just echo'd it, and it looked like it was all one string, but space seperated – Kevin Sep 10 '15 at 20:14
  • think I got it cl_arr=(${cl_scan// / }); seems to do the trick :) Appreceite the help! – Kevin Sep 10 '15 at 20:23
  • 1
    @Kevin I added a section to the answer dealing with arrays. – John1024 Sep 10 '15 at 20:24
  • aye, tried that, and got cat: clam: no such file... tried it with clamscan as welll – Kevin Sep 10 '15 at 20:26
  • 1
    @Kevin Oops. Typo corrected. – John1024 Sep 10 '15 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.