[cobalt-users] Re:

[Willem Koster <W.Koster@xxxxxxxxx>]

 wrote:

> On Sunday 29 February 2004 01:57 am, Willem Koster wrote:
> 
> > Can clamav clean files ?
> 
> According to ClamAV documentation at www.clamav.net, ClamAV, as soon as 
> it finds a virus matching the database of signatures, returns the name 
> of the virus and exits.
> 
> > I'd rather see it clean the virus out of the file
> 
> In checking the website I don't see any examples of using it to scan 
> files on a linux system, but rather only incoming email.  Perhaps I'm 
> missing that somewhere.

That's the majority of applications it's used for, but not the only apparently.
 
> > I'm talking
> > about an actual linux-virus that has infected my cobalt :-(   )
> 
> ClamAV identifies virii from signatures.  The signatures in the database 
> appear to be signatures of Windows virri.  I don't see why it wouldn't 
> find a linux-specific virus if they're in the database.  I've found 
> nothing in the database to indicate that there are or arent' any 
> signatures of linux virii in the database.  Perhaps someone with more 
> experience can answer that.

I did indeed find several linux-binaries infected with linux-virii using clamav. I've found both ELF/Osf.8751 and RST.b   (and some test-signatures)

Willem.