delete virus by clamav

[osama.alani]

hello,
by this command i can scan my server from shell

clamscan --infected --recursive /home/

what is the command to delete virus by clamav for specific domain

and what is the command for the whole domains please ?


Thanks for help

 

[24x7server]

Hello,

To delete the infected files from specific domain, Please try with the following command

/usr/bin/clamscan /home/USERNAME/public_html -ir --remove=yes

And try following command to scan all domains files

/usr/bin/clamscan /home/*/public_html -ir

 

[osama.alani]

thank you
but when i tried to delete infected files it tell me that file can't be removed

what shall i do please ?

Thanks

 

[faisikhan]

What command did you try to delete the infected files?

 

[HostingH]

Hello,

Check the permissions/ownership like attributes.

clamscan /home/USERNAME/public_html -ir --remove=yes >> This command scans and cleans the viruses or files.
You can also use Maldet for scanning the account or servers.

 

[stdout]

Either you aren't root OR the file(s) were deliberately made immutable using chattr.
Have you tried removing removing the immutable flag on the file(s) yet? eg. "chattr -ia filename.ext"

The chattr command does accept the -R (recursive) flag.

-i
A file with the âiâ attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be writ-
ten to the file. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

-a
A file with the âaâ attribute set can only be open in append mode for writing. Only the superuser or a process possessing the
CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

 

[osama.alani]

hello, i'm using

clamscan -ir --remove /home/

to remove and it really removed some files but some other can't be removed
i have no idea what to do

Thanks

 

[stdout]

Have you tried changing the attributes on the file(s) you cannot remove?
You can verify IF a file is immutable by listing the file using "lsattr <filename>".

ie. "lsattr /home/username/thisfile.php"

 

[osama.alani]

Hello,
everything is done , now my server 100% free of trojans
i just did it many times and now it say free of viruses

thanksa lot for help

 

[cPanelMichael]

Hello

You may want to consider moving or quarantining the files in the future instead of deleting them. This will allow you to review the files, or backup certain aspects of the files if necessary.

Thank you.