Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 1 reply
  • Subscribers 3 subscribers
  • Views 5708 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Antivirus for linux not disinfect the file

Svetlomir Frengov

Dear Sirs,
I have installed on my home computer under Linux Mint 18.3 64bit Sophos antivirus for linux. I check it is work fine with www.eicar.org. Every time after starting pc I do the check:
sudo su
/opt/sophos-av/bin/savdstatus             
/opt/sophos-av/bin/savconfig query LiveProtection
cd /opt/sophos-av/bin/
./savupdate

A few days ago in my web e-mail I received "Test.rar". It was a virus file. First I unrar it, then check with terminal for virus:
./savscan -all -f -dn -b -archive /home/svetliof/Internet/ and I get:

Full Scanning

>>> Virus 'Troj/DocDl-DVM' found in file /home/svetliof/Internet/Test/ККК.doc
                
2 files scanned in 6 seconds.
1 virus was discovered.
1 file out of 2 was infected.
If you need further advice regarding any detections please visit our
Threat Center at: www.sophos.com/.../threat-center.aspx
End of Scan.

Ok, it is a virus. I try to disinfect the file: ./savscan -di /home/svetliof/Internet/Test/ККК.doc , but nothing happened:

Quick Scanning

>>> Virus 'Troj/DocDl-DVM' found in file /home/svetliof/Internet/Test/ККК.doc

1 file scanned in 6 seconds.
1 virus was discovered.
1 file out of 1 was infected.
If you need further advice regarding any detections please visit our
Threat Center at: www.sophos.com/.../threat-center.aspx
End of Scan.

Am I using the command -di in correct way? Or Sophos antivirus for linux can only detect, but not disinfect the file? This file in not important for me to be a disinfect, but to practice how to deal with some mine if is infected. 
Thank you very much,
Svetlomir frnegov

 

 



This thread was automatically locked due to age.
  • +1

    Hello,

    There is probably no disinfection routine written for it.  It's likely that the sole purpose of the file is the transport for the payload.  What would disinfecting it even mean in this case, stripping a macro and leaving an empty document for example?

    It's not like the case where a file infector is infecting your files on the computer.  In cases like that Sophos Labs would write a disinfection routine to repair the legitimate files infected by the malware.

    The command line looks correct given the documentation here: https://community.sophos.com/kb/en-us/117346.

    Regards,
    Jak

Unfiltered HTML