Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there a way to scan the entire drive including auto-run and all partitions, including the master boot record (MBR)?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

It seems like that cannot be done with ClamAV. See the comments on this site. Definitions are missing for such viruses as well I don't see the patch applied to the clamav I have installed.

share|improve this answer

Go to where it is mounted (presumably /media/) and run clamscan like you normally would (-r). (Or you wouldn't have to go where it is if you want to use the -i flag)

share|improve this answer
    
But there could be a virus in the mbr, and your method will not check for that. –  Lucy Brennan Feb 11 '12 at 18:10
    
If you did get a virus in your mbr you can just rebuild it and that will get rid of at least a few I know of that will infect it. –  doyler Feb 11 '12 at 18:39
    
I don't know if there is a virus in the mbr, but I want to find out. Not just rebuild. Thanks, though. –  Lucy Brennan Feb 12 '12 at 12:08
    
You can see if the total system memory is seemingly missing bytes to check if your mbr has been corrupted - support.microsoft.com/kb/82923 –  doyler Feb 12 '12 at 17:43

In Linux anything is a file. That includes your devices' MBR. All you need to do is simply preform a scan on the associated device driver file.

To find this do the following in your terminal:

mount | grep -e (media|mnt)

This will search your mounted devices for anything in /media or /mnt. Typical distros use /media/, you should know your location just by browsing to the root of the device.

Next you should see from the output of mount something like the following:

/dev/sdb1 on /media/sdb1 type ext3 (rw)

The device /dev/sdb1 is the second device(b), first partition(1) after the MBR/GUID table. Thus your device file you want to scan is /dev/sdb and you would scan with

sudo clamscan -i /dev/sdb

Make sure you do regular backups with tar(1) and/or dd(1) as well

share|improve this answer
    
Note: If you use pam_usb you can even have this automatically scan the device on insertion. –  Dwight Spencer Aug 3 '13 at 16:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.