4

I want to restore some files from quarantine after I have executed clamscan some times. But I cannot find the quarantine folder in the configuration.

How should I find the address of the quarantined file?

masegaloeh
  • 18,236
  • 10
  • 57
  • 106
smhnaji
  • 619
  • 2
  • 11
  • 24

3 Answers3

6

By default, just running clamscan only identify viruses in a directory. To quarantine, you have to set --move <directory> on the command line.

I'd look at the script/command you're running.

Dan Stark
  • 171
  • 1
  • 5
4

I use clamtk, the graphical front-end for clamav, in Ubuntu.

I found my folder was named "viruses" and located in ~/.clamtk/viruses -- that's a hidden folder, of course.

If you have clamav, perhaps ~/.clamav/viruses or ~/.clam/viruses, etc.
Try searching for a folder named "viruses", but remember to search in your hidden files and directories.

Hope this helps!

theDrake
  • 103
  • 3
Subito Piano
  • 41
  • 1
  • so basically, clamav moved the file from my pendrive to my PC desktop, and... it left (probably) the file recoverable on the pendrive... I wanted to wipe it (as I just did on my PC), now... that filenode will be troubling to be found. So I guess the best thing is just to scan, and instead of quarantine, just wipe it directly. – Aquarius Power Mar 21 '17 at 03:48
0

You should have log where you see lines like: /some/file: moved to /path/to/quarantine/file

log may be in /var/log/clamav or sent to your email, or console/syslog, depending on syntax you run scan

if you need to restore files to original location - may use a bash script: https://github.com/Shrizt/clamav-quarantine-recover

Dmitriy UncoNNecteD
  • 1