Using it

Malware Scanning

Edit on GitHub · last edited 2026-09-10

syn-scan is SynapseOS's malware scanner. It scans files sitting on disk — a folder, a download, a game mod — and puts anything it flags aside where you can get it back.

It does not do the detecting itself. ClamAV finds signatures, rkhunter and chkrootkit do the rootkit checks, and syn-scan gives all three one schedule, one quarantine and one output format, so you read one thing instead of three.

Front-end	Command
The window	Malware Scan in the start menu, or `syn-scan gui`
The terminal	`syn-scan --tui`
Command line	`syn-scan scan ~/Downloads`, `syn-scan status`, `syn-scan quarantine list`, …
Settings	Settings ▸ Malware Scanning — the schedule, the signature updates and the engines

What it looks at

Files at rest, and inside archives. A .zip full of mod files gets opened and each thing in it checked, which is how a Windows executable usually arrives on a machine that plays games.

synguard is the other half and runs in the kernel, watching what programs do — what they execute, open, load and connect to. It never opens a file to see what is inside it, and a .exe sitting in a Proton prefix is just data until something runs it. That is the gap this fills.

Scanning

syn-scan scan ~/Downloads          # one folder
syn-scan scan ~/Games/some-mod.zip # one file, archives included
syn-scan scan --system             # the rootkit and system checks (needs root)
syn-scan status                    # what ran, when, what is outstanding

A scan exits 0 when it found nothing, 1 when it found something, and 2 when it could not run — so it is usable in a script.

Scanning a large folder takes minutes, not seconds. Signature matching reads every byte, and a ~/Downloads holding a few disc images can take a quarter of an hour. Scan the folder you care about rather than $HOME when you are waiting on the answer.

Which engines are installed

syn-scan engines

ClamAV is installed with syn-scan. The other two are optional:

Engine	Install	What it adds
`rkhunter`	`pacman -S rkhunter`	Rootkit and system-file checks
`chkrootkit`	`pacman -S chkrootkit`	A second rootkit opinion. Needs the BlackArch repository — `sudo syn arsenal --enable-repo` if you did not add it at install time

An engine that is not installed is listed as such and skipped. rkhunter ships as root-only, so syn-scan engines shows it as needing root until you run the system checks with sudo.

Quarantine

Nothing is ever deleted. A file you move to quarantine is copied to /var/lib/syn-scan/quarantine — or ~/.local/share/syn-scan/quarantine when you are not root — with a note of where it came from, and the original is removed. Putting it back restores its path and its permissions exactly.

syn-scan scan --quarantine ~/Downloads   # ask about each thing found
syn-scan quarantine list
syn-scan quarantine take <path>          # put one file aside by hand
syn-scan quarantine restore <id>
syn-scan quarantine purge <id>           # delete it for good, after confirming

Restoring refuses to overwrite a file that has reappeared at the original path since. Rootkit findings are never quarantined — rkhunter and chkrootkit report on system checks rather than on a specific file, and chkrootkit in particular warns about perfectly ordinary desktops.

The weekly sweep

syn-scan.timer runs a scan once a week at idle CPU and I/O priority, and survives the machine being asleep at the scheduled time. Results show up in syn-scan status.

systemctl status syn-scan.timer
systemctl disable --now syn-scan.timer   # stop it
syn-scan scan --system                   # run the system half by hand

Settings ▸ Malware Scanning is the same switch with the answer beside it — when the sweep last ran, what it left outstanding, and which engines it had to work with. ⚠ The sweep's record belongs to root and a scan you type yourself is recorded under your own account, so the pane shows both.

Keeping signatures current

clamav-freshclam.service updates the signature database in the background and is enabled when syn-scan is installed. The first download is about 110 MB.

systemctl status clamav-freshclam
sudo freshclam                  # update right now

There is a switch for it in Settings ▸ Malware Scanning, beside the one for the sweep.

The ClamAV daemon (optional)

clamd keeps the whole signature set loaded in memory. It is off by default, because that is around a gigabyte of RAM and scanning works without it.

Turning it on makes repeat scans much faster — syn-scan uses the daemon when it is running, so a scan that took about six seconds to start answers instantly:

sudo systemctl enable --now clamav-daemon.service

Or Keep signatures in memory in Settings ▸ Malware Scanning. ⚠ It will not start until freshclam has finished its first download: Arch's clamav ships no signature database, and clamd refuses to start without one.

Nothing else changes; the same scans find the same things either way.

Leave clamav-clamonacc.service alone. It scans every file as it is opened, which is the job synguard already does in the kernel. SynapseOS masks it.

Security audits

If you run lynis, installing syn-scan is what satisfies its malware-scanner tests: HRDN-7230 and MALW-3282 from ClamAV, MALW-3276 and MALW-3275 from rkhunter and chkrootkit. The tests that ask for a running anti-virus daemon (MALW-3284, MALW-3286) need clamd turned on as above.