Is there a way to scan the entire drive including auto-run and all partitions, including the master boot record (MBR)?
3 Answers
It seems like that cannot be done with ClamAV. See the comments on this site. Definitions are missing for such viruses as well I don't see the patch applied to the clamav I have installed.
In Linux anything is a file. That includes your devices' MBR. All you need to do is simply preform a scan on the associated device driver file.
To find this do the following in your terminal:
mount | grep -e (media|mnt)
This will search your mounted devices for anything
in /media
or /mnt
. Typical distros use /media/
, you should
know your location just by browsing to the root of the device.
Next you should see from the output of mount something like the following:
/dev/sdb1 on /media/sdb1 type ext3 (rw)
The device /dev/sdb1
is the second device(b), first partition(1)
after the MBR/GUID table. Thus your device file you want to scan
is /dev/sdb
and you would scan with
sudo clamscan -i /dev/sdb
Make sure you do regular backups with tar(1)
and/or dd(1)
as well
-
1Note: If you use
pam_usb
you can even have this automatically scan the device on insertion. Aug 3, 2013 at 16:44 -
1didnt work, "Data scanned: 0.00 MB"? it is mounted btw. I tried that at /dev/sdb1 too and the same result.. Mar 21, 2017 at 4:15
Go to where it is mounted (presumably /media/) and run clamscan like you normally would (-r). (Or you wouldn't have to go where it is if you want to use the -i flag)
-
But there could be a virus in the mbr, and your method will not check for that. Feb 11, 2012 at 18:10
-
If you did get a virus in your mbr you can just rebuild it and that will get rid of at least a few I know of that will infect it.– doylerFeb 11, 2012 at 18:39
-
I don't know if there is a virus in the mbr, but I want to find out. Not just rebuild. Thanks, though. Feb 12, 2012 at 12:08
-
You can see if the total system memory is seemingly missing bytes to check if your mbr has been corrupted - support.microsoft.com/kb/82923– doylerFeb 12, 2012 at 17:43