Scanvirus Stable V1.00 Release

Hello all. “scanvirus” is a script application that has clamscan as its anti-virus engine. It has minimal functions to learn and it only has two dependencies (udisks2 and clamav). It makes virus scans of multiple drives/devices much easier. It requires no graphical interface, but has some optional gfx functions. It’s command line is simple and easy to use with a configuration file. It’s a has good configurable logging system.

It’s been throughly tested for bugs and design flaws. However, any bugs or design flaws report them here. Follow the instructions in the script.

Design Flaw: needs more error checking, only basic checks.

Upgrading: Overwrite old file. Check CFG for differences

______________________________scanvirus configuration______________________________
date +'%Y-%m-%d %I:%M:%S%P'
TimeStamp= %I:%M:%S%P
DateStamp= %Y-%m-%d
ExcludedScanFolders= dev etc kdeinit5__0 proc tmp srv sys var .snapshots
Bash Suspend Command
1= 'systemctl suspend' - openSUSE, Ubuntu, Fedora, Arch, Debian, etc
2= 'pm-suspend' - Void, Gentoo, Devuan etc - pm-utils power management suite
SuspendCommand= 1
Suspend or power-off lock screen - GNOME KDE
LockScreenCommand= 0
MSWIN scan - partition file system types
ScanPartitionFileSystems= ntfs vfat
List users group filter
UserGroupFilter= users
Scan Log Format
%o  OS Type             %s  Virus Status
%f  Scan Folder         %n  Scan Time
%c  Command Options     %t  Time Stamp
%d  Date Stamp          %p  Partition Log
%%  Print %
ScanLogFormat= %o %s %f %n %c %t %d %p

Software License:

#sha256sum scanvirus
c98e5f8ed8719daeead50d84053f0b12471f6a9637397aa4889ea92e21a0856c  scanvirus

#sha512sum scanvirus
37b848c468227f6da7cb8ed0190862e965ec5ea94ad810640641af3bc961aa3d5d9f24b1c74637febcdc42b96504b50baf93e629f091dde897b9ba48476f03e7  scanvirus

Current project: A total conversion to C code for more speed. It has only basic functions.

Not a request for technical help. Will be moved to General Chitchat.

Noted for later releases.

No such file or directory
WARNING: : Can't access file

Ignore: clamscan engine issue, unknown

There is an error sometimes when scanvirus completes, some kind of bash bug unrelated to scanvirus or other system bug.

Future Fix: There is possible problem with someone altering the config file to remove ‘virus’ or ‘clean’. There is no current way to log changes to that file.

===== Security Patch =====
Now checks and corrects for missing virus status ‘%s’.

Make changes as noted. If you have done it correctly, the sha256 and sha512 should match. If not, make sure there are no extra lines at the end of the script. Also, spacing could make shasums incorrect.

Code patch → build date top – > build date version bottom

     if  "$ScanLogFormat" == '' ]];then
          printf "cfg error: ScanLogFormat NULL
          exit 1
     if  "$ScanLogFormat" != *"%s"* ]];then
          printf "cfg error: ScanLogFormat missing virus status
          printf "Adding Virus status to ScanLogFormat
          ScanLogFormat+=" %s"
     #exit 1

#: Last Edit   : Mon  Aug 13  20:35 PST 2020
printf "Build #2020.
sha256sum scanvirus
9f4c9cc2662363d7f232ddd17b9084e2cf6bbecc2081c39e4b9b69308425e756  scanvirus

sha512sum scanvirusa
9d28f94ae2e8c627935b02d9f953a1a363051b81b25dbe7b104904ea1277f26bad924b870b84375a31c0bc637dad2f1d1986d7602b9028b98c61ecab7d6706d5  scanvirus

===== Security Patch =====
Adds warning to scanlogs about missing virus status.

Make changes as noted. If you have done it correctly, the sha256 and sha512 should match. If not, make sure there are no extra lines at the end of the script. Also, spacing could make shasums incorrect.

Code patch → build date top – > build date version bottom

     if  "$ScanLogFormat" == '' ]];then
          printf "cfg error: ScanLogFormat NULL
          exit 1
     if  "$ScanLogFormat" != *"%s"* ]];then
          printf "cfg error: ScanLogFormat missing virus status
          printf "Adding Virus status to ScanLogFormat
          ScanLogFormat+=" %s"

          Current_Date=$(date +'%m/%d/%Y')
          printf "%s WARNING: ScanLogFormat missing virus status
" "$Current_Date" >> /var/log/VirusVault/VirusScanLog.txt

#: Last Edit   : Mon  Aug 19  22:28 PST 2020

         printf "Build #2020.

#sha256sum scanvirus
292afc9b9310dc40d85cc2ea57aaa7e584f57953f560f9a96d7f35440c50f1e6  scanvirus

sha512sum scanvirus
b6f0d7621c200cc0018be1409283f2a549cd89940bb2f5de28979527277e9329ef64502803189825e92e0b43a6dff0b6aa4c9db42358272cb63f39b707b0afd0  scanvirus

Just a general comment of the possible increasing need for Linux Anti-Virus,

Although the recent reveal of Drovorub won’t likely be identified by common AntiVirus,

Drovorub may be an early indicator that some hackers are recognizing that even if Linux doesn’t exist in large Desktop/Workstation numbers, it can still be a worthwhile target because critical high value systems often run on Linux.

If we continue to see more exploits like Drovorub that specifically target Linux machines, then anti-malware in general and anti-virus in particular could become essential rather than merely optional.


I’ve done my best to get out any security flaws in scanvirus. But, I’m still limited by the engine being out of date.

WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.100.3 Recommended version: 0.102.4

I would release scanvirusbin, but it has too many potential flaws. Not to mention memory leaks and filename overflows. On the good side, I have completed ‘scanvirusbin -l f bin’. Scanning and saving the log in the virus scan folder.

Any virus can be detected? Some viruses have a special app to detect them.

I have secure boot disabled. Can I just do an update install to enable?

For your information, I’ve been taking a very hard college class and are very busy.

I have come up with some new function ideas, based on my use of it. Again, suggestions post here.

The "scan interrupted’ log messages are useful, but tend to clutter the logs. So, a cleaning function needs to be added. Since, I am constantly deleting them from the logs.

Sometime in the future, a sort logs into folders function will be added. I think it might be useful. Also, a compress folder similar to an existing function.

A log separate function to use a ‘--------------------------------’ to separate by year – > month for easier viewing of the full log.

For those reading this thread, this a pre-release beta. Just one new feature, ‘clean logs’. No text replace, full download, This will be available for 3 months.

sha256sum scanvirus
b894e47c6cace44015d2130ac2bdfbe458aa8a2849d49130c7e87e8a8a889657  scanvirus

sha512sum scanvirus
dff974862f2a11b07d157441b206494b3df4f180fda91799da1acd87e754d159839769c810b7228dc58d56a568177ee6ce57afbc285f181eea5374bd17b4211d  scanvirus

I’m thinking of some ways to sort and archive the scanlogs into a compressed zip file.

I have a simple idea to make the logs more human readable. You run the command and it formats the current logs something like this. Any new log entries are still the same. I’ll have to add code to support the new format or a separate formatted file with a command to view it.


There are supposed to be spacing there,


There is a security issue with the ‘-cl’ function. So, don’t use this or just remove it from scanvirus.

If a directory is named with ’ Scan interupted: ’ in the {partition list}, then the entry will be deleted virus or not.

interupted is misspelled, missed that.

I need to work out how to solve the combined problem.

The ‘-cl’ command can clear lines with ‘virus found’. Filenames with same name, ‘Scan Interrupted’, might cause a problem. I need to think about it more. Scans can be interrupted after a virus found line. This is serious security issue.

Solution, I just skip ‘scan interrupted’ line with ‘virus found’. You can still delete the line manually while having the handy clean function. I should be able to create a simple fix and post the code.

The filename issue needs to be researched. For now, filenames don’t usually have spaces before and after. The search uses spaces before and after. As far as I know, search ’ scan interrupted ’ should work without any security issues.

I need to test this before I release any new beta. Always check the build #, not the version #.

I’m working on a fix. I found that ‘scan interrupted’ doesn’t use the the standard output. So, it doesn’t display ‘virus’ in the line, but it does move the folder if virus is found. So, I need to review how the control-c cancel scan works.

I can use the standard output and add ‘interrupted’ to the line to remind you of an canceled scan. I can add ‘virus’ to the line only.

I’ll post again once the new design is completed.

I think I have simple design change that works. It will change the formatting of ‘control-c’ output. So, there is a need for an optional upgrade function. It won’t be in the help menu.

scanvirus --upgrade

The upgrade will do various tasks, depending on the version. ----- Don’t use it more than one time---- Putting in safeguards will be too much coding. Use more than twice at you own risk. First time, use ‘-u’ at your own risk

fixes: next --upgrade
interrupted spelling error
possible conversion of old ‘scan interrupted’ to new format
fixes the formatting error in the scanlog: ‘start/end date:’ to ‘start/end:’ (scanvirus bug fix in next beta release)


completed scan:

date {formatted line}

interrupted scan:

date canceled {formatted line}
date interrupted {formatted line}

I’ll may add this to the config file. For, now i’ll just point out the line to change. (if you want your own word)

Once it passes the tests, will be the beta release. Sometime next month,

I was able to create a simple change to ‘update_scanlog’ to allow it to include ‘$cancel_scan_string’. Adding it to the trap – >control_c → call update_scanlog is complex, but not impossible. I could just correct the bad formatting and leave out missing data, but this will make the output cleaner.


Scan_Time can be ‘0’ or I can grab the current time to get total time with some more coding.

Scan_Logs will show all scanned folders completed as of the control-c

MSWIN should have the same basic formatting.

The only visible difference between completed and canceled scans should be 'canceled ’ {formatted cfg file line}.

I have finished the final design and coding for ‘scan interrupted’. There some security issues with the ‘-cl’ function that need to be worked out.

Start: date and time
End: date and time
Calc: Total Scan Time

typical line:
ostype virus/clean total_scan_time TIme Date {folder_list}

canceled ostype virus/clean interrupted_scan_time tIme date {folder_list}

Not knowing the date and time a scan was canceled could be security issue.

Replacing interrupted_scan_time with time_date_canceled is a good security fix,

Using CFG file to remove scan interrupted might cause security issues. But, if I just add the ‘-cl’ clean logs functions, it might be the better solution.

Cleaning the logs also adds a time and date logs were cleaned, another security fix.

Bug fix: ‘Start date:’ → ‘Start:’ and fix ‘End date’.

The control-c code had some major design problems, because of my lack of understanding of how trap works. I’m doing a complete redesign of control-c. The output is much cleaner after using control-c in the scanlogs and after the current scan is canceled. Both linux and mswin scans will have this upgrade.

canceled: linux clean bin 0h:0m:1s none 08:39:51pm 2021-02-11 {}
canceled: linux clean / 0h:0m:34s none 09:17:55pm 2021-02-11 {.Trash-0;bin;boot;home;lib}

For security reasons, the ‘canceled:’ variable will not be in the config file. You will be able to set this var at the beginning of the script. Later, you can set it’s position as start ‘0’ or end ‘1’ either in the config file or in the script as another var (next to canceled_var).

Scanning lib
No such file or directory
WARNING: : Can't access file

I can’t find a reason for the above bug. Instead, I’m going to try fix the ‘start date:’ bug and finish the upgrade to control-c.

I’ve completed the upgrades to the linux scans if you press control-c. I’ve run into some error in the mswin scan. It could be a system bug. So, I’m going to wait a few days for the problem to be fixed.

#----------------------------------------------------------------cut devicename
Mount_Point=$( lsblk -l -o name,mountpoint | grep "${Temp_MP}" | sed "s/${Temp_MP} //g" )
sed: -e expression #1, char 23: unknown option to `s'

I trace the problem back to the top level read statement. ID #s clipped for security.

#blkid | sed 's/: /:/g' | sed 's/\" /:/g'


Could be a system bug or my code,

For those who are paying attention to this blog, this is a scanvirus v1.01 - beta (1 week exp)

search and replace all ‘scan interupted:’ in the logs – > ‘Canceled’. (& interrupted)

I’ve overhauled the control-c interrupt system. It’s exits cleaner and smoother for both mswin and linux scans

Note: -cl function is null for now. I don’t recommend using it. Leave the ‘Canceled’ scan entries for the next release.

If you want to change the ‘Canceled’ message, it’s at the beginning of the scanvirus file.


CFG controls for ‘Canceled’ - start and end (easy)
Fix ‘-cl’ function.

New idea:

scanvirus scan filters - usb only or internal only for both linux and mswin scans. (auto-mounting as usual).

Note: scanvirus -l f folder

This can be used to scan both linux and mswin systems. To get the usb address, use the ‘edit’ function on the folder bar.

I have two completed the two new functions. Security should be enough for now.

backup logs - backup scanlogs with date and time
p1: -bl or --backuplogs

clean logs - remove ‘Canceled’ lines (except with ‘virus’)
p1: -cl or --cleanlogs

If you change this, remember to search and replace the old tag.


CFG start and end tag addition might cause problems.

The USB and/or SATA filter is next.