5

I have a CentOS server storing files for windows users.

How do I scan for windows viruses in these files, and meanwhile prevent quarantine and other measures?

I do not want the files altered in any way, and would prefer if it can be done purely in command line with parsable results.

The antivirus we have a license for is Kaspersky Endpoint Security. That is the preferred antivirus, but the question applies to Linux Anti-viruses in general.

Improve this question
10
  • Did you check out kapersky for linux ?
    – user9517
    Oct 12, 2016 at 22:54
  • This is definitely possible since VirusTotal does so, but I would also like to know how to do so.
    – Sainan
    Oct 12, 2016 at 23:02
  • Yes. Actually mentioned it in the question as the antivirus of choice. Do you know how to : 1. Run it from commandline 2. Prevent it from quarantining and 3. does it find windows viruses? 4. How to parse it's results in commandline? (for automation) if you have an accurate answer I am sure this is a common problem!
    – DannyZB
    Oct 12, 2016 at 23:03
  • Do you setup your windows OS AV to scan network share ?
    – yagmoth555 ♦
    Oct 13, 2016 at 2:01
  • It's not a network share. It's a RedHat EL server with files stored on it(part of a product). Some relevant resources I've found so far: support.kaspersky.com/4320 support.kaspersky.com/4318 support.kaspersky.com/4322 support.kaspersky.com/4323 support.kaspersky.com/4326
    – DannyZB
    Oct 13, 2016 at 7:51

1 Answer 1

Reset to default
1

Untested, but if you are happy using ClamAV the following should work:

Install the ClamAV (enabling EPEL repo first):

yum install -y epel-release
yum install clamav

Via: https://www.clamav.net/documents/installing-clamav#rhel

Then you can update ClamAV:

/usr/bin/freshclam

Then scan:

/usr/bin/clamscan -r --infected /

--infected (-i): Only print infected files. --recursive (-r): Scan directories recursively. All the subdirectories in the given directory will be scanned.

It's worth noting that by default clamscan does not remove files, you would have to manually set the switch: --remove[=yes/no(*)]

Via: https://linux.die.net/man/1/clamscan

Regarding scanning for windows signatures in linux I will refer you to this accepted answer on AskUbuntu: Does ClamAV Scan Windows virus?

In practice however, you will mainly use a virusscanner to protect your Windows partners. ClamAV does scan for Windows viruses as well.

Improve this answer
3
  • Thanks for the comment. While this may be true, I rather doubt ClamAV is very effective against Windows threats - It's not one of the leading antiviruses.
    – DannyZB
    Oct 13, 2016 at 7:52
  • You're probably right. I guess it was designed for mail scanning. Have you looked into setting up a windows client (VM or physical) and just using a commercial client?
    – Andy Verhoef
    Oct 13, 2016 at 22:47
  • 1
    clamav is part of CentOS. Every windows-threat that was detected SEP was confirmed by clamscan. So it should work.
    – Nils
    May 16, 2017 at 19:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .