Malware Scanning

Malware Scanning

syn-scan is SynapseOS's malware scanner. It scans files sitting on disk — a folder, a download, a game mod — and puts anything it flags aside where you can get it back.

It does not do the detecting itself. ClamAV finds signatures, rkhunter and chkrootkit do the rootkit checks, and syn-scan gives all three one schedule, one quarantine and one output format, so you read one thing instead of three.

Front-end	Command
The window	Malware Scan in the start menu, or syn-scan gui
The terminal	syn-scan --tui
Command line	syn-scan scan ~/Downloads, syn-scan status, syn-scan quarantine list, …
Settings	Settings ▸ Malware Scanning — the schedule, the signature updates and the engines

---

What it looks at

Files at rest, and inside archives. A .zip full of mod files gets opened and each thing in it checked, which is how a Windows executable usually arrives on a machine that plays games.

synguard is the other half and runs in the kernel, watching what programs do — what they execute, open, load and connect to. It never opens a file to see what is inside it, and a .exe sitting in a Proton prefix is just data until something runs it. That is the gap this fills.

---

Scanning

syn-scan scan ~/Downloads          # one folder
syn-scan scan ~/Games/some-mod.zip # one file, archives included
syn-scan scan --system             # the rootkit and system checks (needs root)
syn-scan status                    # what ran, when, and each thing it found
syn-scan status --weekly           # the same for the weekly sweep, from any account

A scan exits 0 when it found nothing, 1 when it found something, and 2 when it could not run — so it is usable in a script.

Scanning a large folder takes minutes, not seconds. Signature matching reads every byte, and a ~/Downloads holding a few disc images can take a quarter of an hour. Scan the folder you care about rather than $HOME when you are waiting on the answer.

Which engines are installed

syn-scan engines

ClamAV is installed with syn-scan. The other two are optional:

Engine	Install	What it adds
rkhunter	pacman -S rkhunter	Rootkit and system-file checks
chkrootkit	pacman -S chkrootkit	A second rootkit opinion. Needs the BlackArch repository — sudo syn arsenal --enable-repo if you did not add it at install time

An engine that is not installed is listed as such and skipped. rkhunter ships as root-only, so syn-scan engines shows it as needing root until you run the system checks with sudo.

rkhunter compares the system's commands against a stored record of them. syn-scan keeps that record current: after every package update it records the files pacman changed, and nothing else. The first record is made when both are installed, and each file in it is checked against its package first. A command reported as changed was therefore changed some other way. Check it against its package before anything else:

pacman -Qo /usr/bin/ls           # which package it belongs to
sudo pacman -Qkk coreutils       # does that package still match what it shipped

---

Quarantine

Nothing is ever deleted. A file you move to quarantine is copied to /var/lib/syn-scan/quarantine — or ~/.local/share/syn-scan/quarantine when you are not root — with a note of where it came from, and the original is removed. Putting it back restores its path and its permissions exactly.

syn-scan scan --quarantine ~/Downloads   # ask about each thing found
syn-scan quarantine list
syn-scan quarantine take <path>          # put one file aside by hand
syn-scan quarantine restore <id>
syn-scan quarantine purge <id>           # delete it for good, after confirming

Restoring refuses to overwrite a file that has reappeared at the original path since. Rootkit findings are never quarantined — rkhunter and chkrootkit report on system checks rather than on a specific file, and chkrootkit in particular warns about perfectly ordinary desktops.

---

The weekly sweep

syn-scan.timer runs a scan once a week at idle CPU and I/O priority, and survives the machine being asleep at the scheduled time. syn-scan status --weekly lists what it found, and needs no sudo. The window opens on the same list.

A check listed as Did not finish is an engine that stopped part-way — for example rkhunter unable to write its log. That sweep is incomplete, and the entry says nothing about what is on the machine, so it is not counted as a finding.

A file listed as Unreadable is one ClamAV could not open or unpack, such as a damaged archive. It appears by name under files could not be scanned and is not counted as a finding either: nothing was found in it, and nothing was checked.

systemctl status syn-scan.timer
systemctl disable --now syn-scan.timer   # stop it
syn-scan scan --system                   # run the system half by hand

Settings ▸ Malware Scanning is the same switch with the answer beside it — when the sweep last ran, each thing it left outstanding, and which engines it had to work with. ⚠ The sweep's record belongs to root and a scan you type yourself is recorded under your own account, so the pane shows both.

---

Keeping signatures current

clamav-freshclam.service updates the signature database in the background and is enabled when syn-scan is installed. The first download is about 110 MB.

systemctl status clamav-freshclam
sudo freshclam                  # update right now

There is a switch for it in Settings ▸ Malware Scanning, beside the one for the sweep.

---

The ClamAV daemon (optional)

clamd keeps the whole signature set loaded in memory. It is off by default, because that is around a gigabyte of RAM and scanning works without it.

Turning it on makes repeat scans much faster — syn-scan uses the daemon when it is running, so a scan that took about six seconds to start answers instantly:

sudo systemctl enable --now clamav-daemon.service

Or Keep signatures in memory in Settings ▸ Malware Scanning. ⚠ It will not start until freshclam has finished its first download: Arch's clamav ships no signature database, and clamd refuses to start without one.

Nothing else changes; the same scans find the same things either way.

Leave clamav-clamonacc.service alone. It scans every file as it is opened, which is the job synguard already does in the kernel. SynapseOS masks it.

---

Security audits

If you run lynis, installing syn-scan is what satisfies its malware-scanner tests: HRDN-7230 and MALW-3282 from ClamAV, MALW-3276 and MALW-3275 from rkhunter and chkrootkit. The tests that ask for a running anti-virus daemon (MALW-3284, MALW-3286) need clamd turned on as above.

---

See also

• synguard + kmod — the kernel-side monitor
• Software — installing and removing packages
• Files — the file manager