Virus detected on file download HELP!

Virus detected on file download HELP!

by Irith Herman -
Number of replies: 7

I"m running  moodle vwersion 3.3.2

Yesterday I could"t download files from my moodle site.

I got this error while downloading :virus detected on file download

 Is there any solution?

IRITH




Average of ratings: -
In reply to Irith Herman

Re: Virus detected on file download HELP!

by Ken Task -
Picture of Particularly helpful Moodlers

Think you might have  share more info that what has been shared so far ... eventually?

Do you have another workstation you could use to login and attempt to download some linked file that produced the error?

Is it a false positive?

Do you have anyway to scan moodledata/filedir (assuming it was a file that was uploaded via the Moodle Admin UI)?

IF you cannot, and you are remotely hosted, maybe the support staff where you host can scan?

'spirit of sharing', Ken


In reply to Ken Task

תשובה ל: Re: Virus detected on file download HELP!

by Irith Herman -


.I received a complaint from several teachers and I tried from several separate computers

 We have a private linox server but the support staff   told me that he doesn"t know how to scan  for virus We have more moodls on this server I checked some of them and there is no errors.

how can and where can I scan?

Irith

In reply to Irith Herman

Re: תשובה ל: Re: Virus detected on file download HELP!

by Ken Task -
Picture of Particularly helpful Moodlers

Support staff can probably install a free antivirus for Linux called ClamAV - either through a repo or manually.

Please see:

https://www.clamav.net/ for download @ https://www.clamav.net/downloads

After it's installed, support staff will want to scan all of moodle code and moodledata.

Look at the config.php file of the code directory for locations of code and moodledata.

**Example**:

moodledata is in /var/www/

to scan all of moodledata ssh into server as root  user (or sudo to root).

cd /var/www/moodledata/

clamscan -r * [ENTER]

Since most Moodle data directories *are* large, even on small/medium sites,  that will take some time.

Also scan the web document root

For specifics, google is your friend.

'spirit of sharing', Ken



In reply to Ken Task

תשובה ל: Re: תשובה ל: Re: Virus detected on file download HELP!

by Irith Herman -

Thank you Ken

We installed the antivirus and scanned the moodldata file 

it didn"t find anything

 I will reinstall  the moodle  may be this will help


Irith

In reply to Irith Herman

Re: תשובה ל: Re: תשובה ל: Re: Virus detected on file download HELP!

by Ken Task -
Picture of Particularly helpful Moodlers

Can you provide an example of what folks are clicking upon to get that virus reported?

What desktop OS are folks using?

What antivirus is installed on those desktops?

Does your private LAN/WAN have a network AV scanner?

'spirit of sharing', Ken


In reply to Ken Task

תשובה ל: Re: תשובה ל: Re: תשובה ל: Re: Virus detected on file download HELP!

by Irith Herman -

Thank you very much for lighting my eyes and sending me to check the browsers.


I checked earlier on an old Windows XP computer that does not have a new browser installed and the files went down without a problem

I checked my computer and saw that in Firefox the mcafee antivirus checks the files that I download and delete them.

I removed the antivirus from my computer and now everything is OK you can download the files.

I'll let the other lecturers do it.


Irith

In reply to Irith Herman

Re: תשובה ל: Re: תשובה ל: Re: תשובה ל: Re: Virus detected on file download HELP!

by Ken Task -
Picture of Particularly helpful Moodlers

Glad we've determined there is nothing ClamAV found on the server, but ....

am not sure if what you are doing/thinking is correct nor safe. 

IF you are relying on ClamAV on the Moodle server to protect it from accepting files containing a virus and thus protecting workstations by proxy, you should know that ALL antivirus apps are NOT 100% and that new viruses/malicious software, etc. is continual and on going.   AV is only as good as it's AV definitions and engine to ID such files correctly.

Get your techs to check out the Macafee on workstations is up to date and functioning.

Turning it off on a Windows PC is not something I'd advise.

Best of luck!

'spirit of sharing', Ken