I think I might have a virus on my windows partition and I want to scan it from Ubuntu. Is this possible? I would like a program that is free.
clamAV
I tried clamAV but I couldn't find a setting for scaning my other partition that I have windows on, it scaned my Ubuntu disk and that was fine.
Antivirus Within Windows
I can't use my Windows partition since the virus make my laptop freeze every time I log in. And I don't want it to spread or make more damage than it might have done already.
There is lots of bootable anti virus disks you can use, I would recommend AVG Free. AVG has over 110 million user. It provides antivirus protection for Linux/FreeBSD for free.
To download click here.
To start using AVG, just press Ctrl+Alt+T on your keyboard to open Terminal. When it opens, run the command below
More on help.ubuntu.com
However I would suggest that you run an up to date anti-virus scanner from within your windows partition. Or you can use Bitdefender. Boot CD available here
For the top 5 Anti virus for Ubuntu. See here
1Source:Ubuntu Documentations
It is possible to scan your windows partition. I recommend you do it off a live CD (32 bit).
Download and install Avast! Linux Home Edition.
Launch Avast and update its Database.
Now mount your Windows Partition.
Click on Selected folders and browse to your partition.
Click start scan.
Install ClamTk - that is a graphical frontend for ClamAV, the command line antivirus mentioned here.
Did you already try Clamav?
You said you didn't find a setting within clamAV to scan other partitions. What about:
to show only infected files add the
-i
switch Perhaps you should do asudo freshclam
before scanning to update your virus definitions.Though my way of solving such problems isn't related to Ubuntu, it still may be valuable.
One of the best antiviruses - Kaspersky Anti-Virus - provides a method to cure severely infected installations of Windows. They provide Rescue Disk in ISO format and it is absolutely free. It is powerful and fully functional. It is based on Gentoo distribution with KDE. You can burn it to DVD or make a bootable USB.
Boot from it (it can be run in grahical and text modes). There are several shortcuts on the desktop. Run "Kaspersky Rescue Disk", update the virus definitions, because they are old (you will need to setup Internet connection). Select the objects you wish to scan (boot sector, start-up objects, partitions) and press "Start Objects Scan" button.
This ISO can be downloaded here: https://support.kaspersky.com/viruses/rescuedisk.
On the same page you will find several guides: how to burn disk, how to use the product. These guides are detailed and pretty explanatory so I decided not to duplicate them here. Also there you can find some info regarding UEFI.
Avira also offers a rescue cd, which can be downloaded here: http://www.avira.com/en/download/product/avira-rescue-system. It is a standalone live CD. Just boot it, update the signature files, and run it. You can also install clamAV and scan your windows partitions with it if you can mount them under Ubuntu. This should be relatively safe, as it is very unlikely that you have a cross-platform virus on your windows partitions. However, it is not entirely impossible, so using a live cd is the safer option here!
Avast now supports Linux based servers only. I had a response from Avast support to similar query. The only commercial package available at http://www.avast.com/linux-server-antivirus
clamscan
works for Ubuntu home as default. It can be made to scan other partitions, including windows partitions, provided you define the path properly.I tried in the terminal:
sudo clamscan -r --move=/tmp/virus /mnt/windows-partition
The first error was about
/tmp/virus
. There was no such directory in my system. So I had to create it.Then again there was an error for
/mnt/windows-partition
:Workaround
The path can be found by double right clicking on the Windows partition on the left menu. Then, on the left pane, if you hover the cursor the path details are shown. Else right click on the Windows partition, left click on "Properties", then you will find in the Basic Menu "Location: /media/"volume_name" (without quotes. This will be after Name, Type, Contents) and add the "Name" of the partition on top, such as:
("Name_of_partition". 16 digits in my case)
I tried the following
clamscan
command and it worked:sudo clamscan -r --move=/tmp/virus /media/"volume_name"/2ABC123903A129B4A
I had "Flash Pro" malware, which was choking my internet browsing both in Windows 8.1 and Ubuntu 14.04 LTS 64 bit version.
I used the approach suggested above with some minor changes
First make sure the partition is mounted. The easiest way to do so is to click on it in your file navigator. Also windows needs to be shut down correctly (no hibernation)
create a directory for FOUND items
mkdir virusscan
execute clamscan
sudo clamscan -r --copy=virusscan --bell --log=virusscan/log /media/{yourusername}/
The reason why I advise to use
--copy
instead of--move
and then delete items, is that turn out to be malware by hand is thatclamav
at least in my case found a lot of false positives. If you use--move
you have to copy them back by hand.Also you can use the
-i
flag so that the output only shows infected files. (for more information on the command flags useman clamav
)