search

dave-theunsub / clamtk

An easy to use, light-weight, on-demand virus scanner for Linux systems
https://gitlab.com/dave_m/clamtk/wikis/home
Other
357 stars 46 forks source link

No warning for hard links #121

Open eqjjh opened 4 years ago

eqjjh commented 4 years ago

I got a lot of results in /timeshift, and since timeshift is supposed to be a backup, I didn't realize a lot (all?) of the results were actually links to the original files, and just deleted a large number of files.

ClamTK should perhaps show the 2 duplicated files together, or have some indication that files are duplicated, maybe with some sort of highlight. Not sure how they are displayed in the terminal version, or if this is just a linux issue.

There is potential for serious harm without having this information available.

eqjjh commented 4 years ago

This could be an issue with ClamAV itself depending on how the results are displayed: https://unix.stackexchange.com/questions/478908/using-clamav-efficiently-when-timeshift-snapshots-are-present

eqjjh commented 4 years ago

Not actually sure that the files were deleted, because they appear grayed out in the results section. What does it mean?

dave-theunsub commented 4 years ago

Hi @eqjjh ,

A file is grayed out when it has been deleted or quarantined.

Thanks, Dave M

dave-theunsub commented 4 years ago

I'm not familiar with Timeshift much, but it's easy enough to add a filter for it. I'll try adding it to 6.05.

Thanks, Dave M

dave-theunsub commented 4 years ago

@eqjjh ,

Scans can have the options:

    --follow-dir-symlinks[=0/1(*)/2]     Follow directory symlinks (0 = never, 1 = direct, 2 = always)
    --follow-file-symlinks[=0/1(*)/2]    Follow file symlinks (0 = never, 1 = direct, 2 = always)

I can add these to 6.07 which may also help.

Thanks,
Dave M