9

Is there a way to scan the entire drive including auto-run and all partitions, including the master boot record (MBR)?

3 Answers 3

1

It seems like that cannot be done with ClamAV. See the comments on this site. Definitions are missing for such viruses as well I don't see the patch applied to the clamav I have installed.

5

In Linux anything is a file. That includes your devices' MBR. All you need to do is simply preform a scan on the associated device driver file.

To find this do the following in your terminal:

mount | grep -e (media|mnt)

This will search your mounted devices for anything in /media or /mnt. Typical distros use /media/, you should know your location just by browsing to the root of the device.

Next you should see from the output of mount something like the following:

/dev/sdb1 on /media/sdb1 type ext3 (rw)

The device /dev/sdb1 is the second device(b), first partition(1) after the MBR/GUID table. Thus your device file you want to scan is /dev/sdb and you would scan with

sudo clamscan -i /dev/sdb

Make sure you do regular backups with tar(1) and/or dd(1) as well

2
  • 1
    Note: If you use pam_usb you can even have this automatically scan the device on insertion. Aug 3, 2013 at 16:44
  • 1
    didnt work, "Data scanned: 0.00 MB"? it is mounted btw. I tried that at /dev/sdb1 too and the same result.. Mar 21, 2017 at 4:15
3

Go to where it is mounted (presumably /media/) and run clamscan like you normally would (-r). (Or you wouldn't have to go where it is if you want to use the -i flag)

4
  • But there could be a virus in the mbr, and your method will not check for that. Feb 11, 2012 at 18:10
  • If you did get a virus in your mbr you can just rebuild it and that will get rid of at least a few I know of that will infect it.
    – doyler
    Feb 11, 2012 at 18:39
  • I don't know if there is a virus in the mbr, but I want to find out. Not just rebuild. Thanks, though. Feb 12, 2012 at 12:08
  • You can see if the total system memory is seemingly missing bytes to check if your mbr has been corrupted - support.microsoft.com/kb/82923
    – doyler
    Feb 12, 2012 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .