Clam anti-virus on Ubuntu

Hamish Taylor
Tuesday, 06 January 2009 09:26

Opinion and Analysis

To make it actually useful, there are two components to install: clamav and nautilus-clamscan. The first is the actual ClamAV application, including the automatic updating mechanism, and the second is the integration with Nautilus which enables you to right-click on files and folders and select "Scan for viruses".

Go to System, Administration, Synaptic Package Manager. Click on Search and type in clamav. You'll see clamav appear. Right-click on it and select "Mark for Installation". You might have to accept some other required packages; click Mark. Click on Search again and type in nautilus-clamscan. When that appears (it should be all alone), right-click on it and select "Mark for Installation". It too, might have some dependancies.

Click on Apply and wait for the packages to download and install. clamav-base (one of the dependancies) is quite large at about 19.5MB so depending on your Internet connection, it might take a while to download.

When the installation has finished, you should be able to right-click on a file or folder and select "Scan for viruses". How long it takes will depend on the size of the files that you are scanning.

ClamAV comes with its own updater that works in the background; you never see it doing anything. I believe that it looks for updates every 4 hours or so. If you want to check that it is up to date, start a Command Line Interface and type in "sudo freshclam" and your password. It should tell you that everything is up to date, unless of course that an update has been released between checks, then it will download and install the update.

You can also invoke the scanner from the command line. Simply move into the directory which you want to scan and type in "clamscan". "clamscan -h" gives quite a few options which may be worth looking at too, including -v for verbose mode, and -r for recursive scanning into sub-directories.

Installing and scanning can be used equally well on an installed system and from the LiveCD. In fact, quite often when in China cleaning a client's laptop involved booting the LiveCD and double-clicking on the icon for their hard disk drive, which mounts it so it is accessible from Linux. Then I would establish an Internet connection (often I worked with backpackers in cafes with open wireless connections), install and update ClamAV and scan their Windows hard disk.

No one anti-virus system is perfect, and I am not positing that ClamAV is perfect. However in my experience it has been enough to get a non-booting infected Windows system clean enough to boot up and continue the cleanup process often using other tools such as AVG anti-virus and anti-spyware, Spy-Bot, AdAware and HijackThis.

As always, please leave feedback, comments and questions. However, I will only respond to comments left on iTWire article discussion forums. The direct link for this article is here.