{"id":8053,"date":"2026-10-17T23:51:18","date_gmt":"2026-10-17T20:51:18","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=support_article&#038;p=8053"},"modified":"2026-10-17T23:51:18","modified_gmt":"2026-10-17T20:51:18","slug":"how-to-scan-computer-manually-using-command-line-with-linux-security-64-or-elements-linux-protection","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/de\/support-articles\/how-to-scan-computer-manually-using-command-line-with-linux-security-64-or-elements-linux-protection\/","title":{"rendered":"How to scan computer manually using command line with Linux Security 64 or Elements Linux Protection"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>How to scan computer manually using command line with Linux Security 64 or Elements Linux Protection ?\u00a0<\/p>\n<h3>Resolution:<\/h3>\n<p id=\"product-short-description\">You can scan the computer for malware manually from the command line of a Linux host that has Linux Security 64 or Elements Linux Protection installed.<\/p>\n<div id=\"product-description\">\n<p>Make sure the user account you run <strong>fsanalyze<\/strong> as has read access to the files, and read and execute access to all directories to be scanned. To rename or remove infected files, the user also needs write access to those directories.<\/p>\n<p>The fsanalyze command scans specified targets (files or directories) and reports any malicious code it detects.<\/p>\n<p>If no files are specified on the command line, fsanalyze reads the standard input for content to analyze. Otherwise, every given file is analyzed and every given directory is scanned recursively, with the following exceptions:<\/p>\n<ul style=\"list-style-type: square;\">\n<li>Special files (such as socket, FIFO, or device files), and files on the \/proc and \/sys special file systems are skipped.<\/li>\n<li>Recursive scanning does not follow symbolic links unless this is explicitly requested with the &#8211;follow command line option.<\/li>\n<li>Recursive scanning does not automatically cross file system boundaries. To scan files mounted on other file systems, specify the mount points explicitly on the command line.<\/li>\n<\/ul>\n<p><strong>Note:<\/strong> The exclusions that are set in the current policy for manual scanning are applied when you use manual scanning from the command line. If you have excluded any paths in the manual scanning policy, recursive scanning crosses file system boundaries.<\/p>\n<ol>\n<li>Run the following command from the shell to start the manual scan: \/opt\/f-secure\/linuxsecurity\/bin\/fsanalyze [OPTIONS] [FILE&#8230;]<br \/>Usage: fsanalyze [OPTIONS] [FILE&#8230;]<\/li>\n<\/ol>\n<p>Analyze each <strong>FILE<\/strong> for potential malicious content. If no file is specified, analyze standard input, in which case the only supported action is <strong>none.<\/strong><\/p>\n<ul>\n<li><strong>-h, &#8211;help<\/strong> Show help.<\/li>\n<li><strong>&#8211;malware=ACTION<\/strong> Action to take when a file is detected as malware. If ACTION is remove the file is removed; if ACTION is rename the file is renamed adding the detection type as an extension; if ACTION is none, the infection is only reported on standard output.\u00a0Default: rename<\/li>\n<li><strong>&#8211;pua=ACTION<\/strong> Action to take when a file is detected as a potentially unwanted application. Options for the action are the same as for malware.<br \/>Default: none<\/li>\n<li><strong>&#8211;suspected=ACTION<\/strong> Action to take when a file is detected as suspicious. Options for the action are the same as for malware.<br \/>Default: none-L,<\/li>\n<li><strong>&#8211;follow<\/strong> Follow symbolic links.<\/li>\n<li><strong>-l, &#8211;list<\/strong> List all scanned files.<\/li>\n<li><strong>&#8211;preserve-atime=VALUE<\/strong> Preserve the access time of files that are scanned. Value can be yes or no.<br \/>Default: no<\/li>\n<li><strong>-q, &#8211;quiet<\/strong> Only output the scan results.<\/li>\n<li><strong>&#8211;scan-archives=VALUE<\/strong> Enable archive scanning. Value can be yes or no.<br \/>Default: no<\/li>\n<li><strong>&#8211;max-nested=NUMBER<\/strong> Set the maximum allowed nesting level of scanned archives.<br \/>Default: 5<\/li>\n<li><strong>&#8211;detect-max-nested=VALUE<\/strong> If enabled, treat archives that exceed the maximum depth as malware. Value can be yes or no.<br \/>Default: no<\/li>\n<li><strong>&#8211;detect-encrypted-archives=VALUE<\/strong> Treat encrypted archives as malware. Value can be yes or no.<br \/>Default: no<\/li>\n<li><strong>&#8211;detect-pua=VALUE<\/strong> If disabled, potentially unwanted applications are ignored. Value can be yes or no.<br \/>Default: yes<\/li>\n<li><strong>&#8211;use-orsp=VALUE<\/strong> If enabled, use the reputation service (ORSP) from Security Cloud. Value can be yes or no.<br \/>Default: yes<\/li>\n<li><strong>-v, &#8211;version<\/strong> Display program version and exit.<\/li>\n<li><strong>&#8211;quoting-style=STYLE<\/strong> Set how to quote the output. If STYLE is url, the output is URL-encoded; if STYLE is escape, ASCII control characters in the output are escaped as &lt;NAME&gt;, and if the output is not redirected to a file, they are also highlighted; if STYLE is literal, the output is printed as is.<br \/>Default: url<\/li>\n<li><strong>&#8211;ignore-exclude-paths<\/strong> Does not use the exclusions set from the current policy for manual scanning.<\/li>\n<\/ul>\n<p>The scanning exit codes are as follows:<\/p>\n<p>0 = scanning was completed with no errors, and no malware, PUA, or suspicious content was detected<br \/>1 = scanning failed for one or more files<br \/>2 = scanning was completed with no errors, but malware, PUA, or suspicious content was detected<\/p>\n<p>\u00a0<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>How to scan computer using command line on Linux Security 64 ?\u00a0<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-8053","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000006110","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-17 20:51:18","import_hash":"9182951c9b6acd99ccc89570da551753e7a86d15","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/support_article\/8053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/media?parent=8053"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/support_article_product?post=8053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}