Virus question

[Bart Silverstrim]

On Feb 11, 2005, at 1:55 PM, Karen Donathan wrote:

> To Whom it may concern:
>
> My name is Karen Donathan and I am a computer science teacher at 
> George Washington High School in Charleston, WV.  We run our website 
> (http://gwhs.kana.k12.wv.us) on a FreeBSD server.  This project was 
> given to me, and I am afraid that I really should know more about how 
> this works.
>
> My question is as follows:  How can I run a virus scan on my system?  
> What scan do you recommend?
>
> The reason I am asking this question is that our school system 
> administrator just found that there were some files infected with 
> Klez.h in the webroot directory of our server.  He found this out as 
> he downloaded some files from this directory to our Windows-XP school 
> server, and Norton flagged it right away.
>
> Any suggestions?

The FreeBSD server itself is immune to that virus.  I'd look at the 
files and ask how they got there (who put them there).

Second, personally I'd recommend you go into the ports tree and install 
ClamAV.  Then you can run Clamscan and that will flag which files are 
"infected".  Then you can go through and delete them or quarantine 
them.

-Bart