5

I have a CentOS server storing files for windows users.

How do I scan for windows viruses in these files, and meanwhile prevent quarantine and other measures?

I do not want the files altered in any way, and would prefer if it can be done purely in command line with parsable results.

The antivirus we have a license for is Kaspersky Endpoint Security. That is the preferred antivirus, but the question applies to Linux Anti-viruses in general.

10
  • Did you check out kapersky for linux ? – user9517 Oct 12 '16 at 22:54
  • This is definitely possible since VirusTotal does so, but I would also like to know how to do so. – Sainan Oct 12 '16 at 23:02
  • Yes. Actually mentioned it in the question as the antivirus of choice. Do you know how to : 1. Run it from commandline 2. Prevent it from quarantining and 3. does it find windows viruses? 4. How to parse it's results in commandline? (for automation) if you have an accurate answer I am sure this is a common problem! – DannyZB Oct 12 '16 at 23:03
  • Do you setup your windows OS AV to scan network share ? – yagmoth555 Oct 13 '16 at 2:01
  • It's not a network share. It's a RedHat EL server with files stored on it(part of a product). Some relevant resources I've found so far: support.kaspersky.com/4320 support.kaspersky.com/4318 support.kaspersky.com/4322 support.kaspersky.com/4323 support.kaspersky.com/4326 – DannyZB Oct 13 '16 at 7:51
1

Untested, but if you are happy using ClamAV the following should work:

Install the ClamAV (enabling EPEL repo first):

yum install -y epel-release
yum install clamav

Via: https://www.clamav.net/documents/installing-clamav#rhel

Then you can update ClamAV:

/usr/bin/freshclam

Then scan:

/usr/bin/clamscan -r --infected /

--infected (-i): Only print infected files. --recursive (-r): Scan directories recursively. All the subdirectories in the given directory will be scanned.

It's worth noting that by default clamscan does not remove files, you would have to manually set the switch: --remove[=yes/no(*)]

Via: https://linux.die.net/man/1/clamscan

Regarding scanning for windows signatures in linux I will refer you to this accepted answer on AskUbuntu: Does ClamAV Scan Windows virus?

In practice however, you will mainly use a virusscanner to protect your Windows partners. ClamAV does scan for Windows viruses as well.

3
  • Thanks for the comment. While this may be true, I rather doubt ClamAV is very effective against Windows threats - It's not one of the leading antiviruses. – DannyZB Oct 13 '16 at 7:52
  • You're probably right. I guess it was designed for mail scanning. Have you looked into setting up a windows client (VM or physical) and just using a commercial client? – Andy Verhoef Oct 13 '16 at 22:47
  • 1
    clamav is part of CentOS. Every windows-threat that was detected SEP was confirmed by clamscan. So it should work. – Nils May 16 '17 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.