A friend of mine has just pointed me to this link, it's a free beta of a virus scanner for linux. Am I just a cynic or is this just the first stage of a plan to scam money from clueless newbies?

I love how they also offer a fee based virus alert mailing list. For only x dollars (or Euro) they'll send you a lovingly crafted email (very expensive to duplicate, I've heard) letting you know about whatever Linux viruses Microsoft is writing.

The funny part is that there at least a couple of virus projects active at Sourceforge.net.

AFAIK the source forge projects are for mail servers, which is a legit linux use of a virus scanner, checking the attachments as the mail passes through so the windoze clients don't get infected.

Virus protection in Linux is a very quickly browsed over topic.

I can see both sides for wanting to release a Virus scanner for Linux.

One:- They obviously do want to start up in a market with no competition - make money.

Two:- For Linux users this could be a good thing. If ppl using Linux get into good security habits (unlike early M$ users) there may never be something like the I LOVE YOU virus for Linux (not in terms of destruction. as a type of virus I shouldn't think so at all), because ppl will be more aware if the possible dangers. It is possible to create virus' for Linux, although there have been hardly any released due to mainly (I feel) the protection of the community. Virus writers already have one huge (vulnerable!) target to aim for. Also, M$ virus' spread further and have a bigger effect.

So is a Linux Virus scanner going to be any good. Well, the only thing that a scanner can do is remove any virus' it knows about - and seeing as there are only a handful for Linux I don't really se much point in using it.

What would be better is for newbies to take precutions, such as limiting the access of normal users to important folders/directories - only use root for essential system work - set correct file permissions.

Like using any OS - be vigilent!

Cragstar wrote:
This is a very true statement. Many friends i know are under the misconception that Linux is immune to viruses, and that is simply not true.

Now it is much more resilient against attacks then MicroSoft products, due to its use of permissions and the fact so many millions of people correct holes in the kernel source sode, but it is still possible to make viruses that hurt a Linux system.

I think once Linux really hits the big time, more viruses will show up. It is simply not a popular target yet.

I know what you mean - before I knew Linux that well I used to make statements to my windows loving friend that "Linux was immune for viruses!".

I've kinda toned that down a bit now.

Does anyone know of any linux viruses about - with any links to info or something?

Cragstar wrote:
A good site to start would be Linux Security Website . They have lots of good info on any discovered holes and breaches, as well as offer news on virus attacks and related material.

Cheers - excellent link.

If I may include worms and other malware into the virus definition, here's Mcafee's uvscan vs RAV on some tarballs:

AVS:
xxx.tar/ifconfig Found the Linux/Rootkit-A trojan !!!
xxx.tar/linsniffer Found the Linux/Rootkit-C trojan !!!
xxx.tar/netstat Found the Linux/Rootkit-C trojan !!!
xxx.tar/ps Found the Linux/Rootkit-C trojan !!!
xxx.tar/sense Found the Linux/Rootkit-C trojan !!!
xxx.tar/sl2 Found the DDoS-Blitz trojan !!!
rootkit/xxxx.tgz/xxxx/xxxx.tgz/bin/sz Found virus or variant Linux/Lion.worm !!!
rootkit/xxxx.tgz/xxxx/xxxx.tgz/tools/mirkforce Found trojan or variant Linux/Mirkforce !!!

RAV:
xxx.tar.gz->xxx.tar->xxxx/ifconfig Infected_with:_Trojan/Linux.RootKit.40_(exact)
xxx.tar.gz->xxx.tar->xxxx/sl2 Infected_with:_Trojan/Blitz_(exact)

No viruses, definately different results, but anyway a way to know if there's something malicious around without having to do "strings" on everything.