[clamav-users] clamav incremental scan?

[Matus UHLAR - fantomas]

On 04.05.21 14:19, Michael Wang wrote:
>It seems that this should be a common question, but I did not find a
>definite answer via Google search. I saw solutions to only scan files in
>the last 60 days,

what solution? Something related to "find ... -mtime"?

> but it is not difficult for a virus file to change date,
>isn't it?

if the above is true, "find ...  -ctime" should do what you want.  ctime is
actualized everytime you change something on file, including modification
time (and ctime of course)

Thus, it's not possible date ctime back without direct access to filesystem
(in which case your problem would be much bigger).


-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Emacs is a complicated operating system without good text editor.