4

I want to restore some files from quarantine after I have executed clamscan some times. But I cannot find the quarantine folder in the configuration.

How should I find the address of the quarantined file?

3 Answers 3

6

By default, just running clamscan only identify viruses in a directory. To quarantine, you have to set --move <directory> on the command line.

I'd look at the script/command you're running.

4

I use clamtk, the graphical front-end for clamav, in Ubuntu.

I found my folder was named "viruses" and located in ~/.clamtk/viruses -- that's a hidden folder, of course.

If you have clamav, perhaps ~/.clamav/viruses or ~/.clam/viruses, etc.
Try searching for a folder named "viruses", but remember to search in your hidden files and directories.

Hope this helps!

1
  • so basically, clamav moved the file from my pendrive to my PC desktop, and... it left (probably) the file recoverable on the pendrive... I wanted to wipe it (as I just did on my PC), now... that filenode will be troubling to be found. So I guess the best thing is just to scan, and instead of quarantine, just wipe it directly. Mar 21, 2017 at 3:48
0

You should have log where you see lines like: /some/file: moved to /path/to/quarantine/file

log may be in /var/log/clamav or sent to your email, or console/syslog, depending on syntax you run scan

if you need to restore files to original location - may use a bash script: https://github.com/Shrizt/clamav-quarantine-recover

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .