Does anybody use antivirus software in Linux?
 

Just wondering how many people think antivirus software is necesary in Linux.

I dont know there were viruses under linux ?

maybe they can put on mail server for windows pop accounts but linux in general i dont htink theres viruses

Ya, there are.........but its only something like 11..........vs. the something like 11,000 in WinBlows ;)

go to www.f-prot.com to download a free anti-virus for linux.

it is good

I don't want to install unnecesarry software on my comp..........is it needed? Or is it a waste of hd space?

well, if you store files that are of no significant use to anyone, you are well protected by a firewall and you have a very good backup rotation with the ability to go back to a point in time before you became infected, since you may not know for some time... then no, you would be ok without it. But being ok, is being willing to be vigilant with all the above precautions. Now, if your system is serving mail for a windows machine or 20,000 and/or files for a lan populated with the holy grail of sieves ... windows, then it may be a good investment, as your machine could propagate a virus to one of your windows machines.

Now, if you are using an email server or web server, you may run the risk of being blacklisted if someone was to use your computer for malicious tasks... so, if your serving any critical functions, then it may not be a bad idea.

I don't personally run any on my home machines, but I do at work as I cannot afford to be blacklisted... or have any significant downtime.

nope. i only use open-source and always download from good sources. i would on a mail server.

I use amavis to screen mails. Particularly if I'm forwarding any to those poor souls who run Windows.

This is an interesting article to read: http://www.theregister.co.uk/content/56/33226.html

But one of the last articles in this search is an interesting response to the previous article: http://www.virusbtn.com/news/latest_news/granneman.xml

No antivirus for me. Come to think of it, I never used it on Windows either and ever since I've been using computers extensively since 1994, I've never had a virus myself. Watch where you download from and don't open up any mail you don't know who its from, etc.

Linux viruses? What the? Do you even need Linux antivirus protection? ;)

Well maybe if you run wine(X) - but even then - it will probably not damage your system - wine will just crash thanks loophole filled, mazy cross-referenced WinAPI. But not damage your system. Hey, running under wine is safer than running it on Windows anyway.

Firewalls too? Well true, maybe if you are running a server, but trying to hack into root access is practically impossible, unless you wish to spend a hundred thousand years or are really, really, lucky. Or unless you surf the net as root. Which some fools still do, and I find people in bzflag having the title (root@whateveryourisp.com).

Although I went to grc.com (excellent aid for your windows API loopholes, shuts down DCOM absolutely, etc.) and my ports weren't stealthed, but closed. (Better than open I suppose, and no big deal, considering I am not running live server)

There have been some rather heated discussions about this in the usenet newsgroups. From what I've been able to find out so far viri are a relatively small problem at this time. But root exploits and trojans are a completely different matter. Since I don't provide any outside services and am on a stand alone box I don't have an antivirus. But I use a firewall and keep chkrootkit updated and run it fairly regularly. Also taking a look at tripwire. Now, if I was networked with some windows machines or providing any sort of outside services I would seriously look at some sort of anti virus protection.

I have a virus detection programme (can't remember what it is called, though). This is not to 'protect' myself, but to verify if I have recieved a virus. Pretty cool things to read through, Windows viruses. It would seem that many of the really badly-written ones do not hide what they're doing at all. I have lost count of the number of times I have recieved a pif/exe/com file that blatently contains instructions to do something with SMTP... hmmm, I wonder what that does?

If I was running a mailserver, then sure I would, but for anything else, I wouldn't worry about it.

"The day microsoft makes a product that doesn't suck is the day they start making vacuum cleaners."
but vacuum cleaners DO suck, that's what they're supposed to do, so even makin vacuum cleaners microsoft would be making a product that sucked.... but seriously, i'm not afraid of a virus in linux as most of the virus writers don't bother writing a virus for a still relative small number of users that choose a REAL os like linux, when they can affect so many more users with less effort by attacking winblows users

"The day microsoft makes a product that doesn't suck is the day they start making vacuum cleaners." The whole point of that is that the vacuum wouldn't work, so it wouldn't "suck." ;)

I'm not using my computer to provide services to anyone, so I guess theres not much of a point in getting Antivirus software

yeah, but if it if it doesn't suck then it still would 'suck' as it wouldn't work, oh well.

lol.........u think about these things too much..................:)

No anti-virus here , just common sense and a hardware-firewall.

True to most polls, my answer is not there to check.
I have the Linux version of F-prot installed to check files I may forward elsewhere.
There are other tools to safeguard your Linux system.

Fun things to say:
"Do you still have a copy of the virus that infected your Windows PC? Would you forward it to me so I can see if my anti virus scanner is working?"

I really don't know all that much about viruses, can someone with a little more of an understanding please inform me?

A) Can a virus cling to an e-mail without being an actual attachment?
B) How hard are they to make? (Not that I'm trying to make one ;))
C) If I had a virus completely and only designed for Windows on a Linux drive, is there any possible way I could infect my system without moving it to a Windows drive or Windows media? (I doubt it, but just making sure)

I can't believe I am the first to answer yes. I'm not particularly worried about virii myself, but I do mail, so my users like that protection. I use ClamAV for mail scanning, and because a little paranoia is a good thing, I do monthly scans of my entire HDD with F-Prot.

Ian

A) Hardly. If it did, it wouldn't execute. You could find a loophole though, I might not know of.

B) What virus are you thinking of? You're like saying, "how hard is it to write a story"? Yours could be a Tolkien, or maybe a children's nursery book, targeted at different things and different systems, or different aspects of them. ;) Its all a matter of which loopholes you find too, or how fast you type. ;) Assembly or HLL? I also created a fake virus once that scared my classmates. It was a javascript alert program really that displayed window boxes of how your computer was being controlled. I also create a fake "control centre" for that to boot. But all it did was really read from and write to a text file using perl. Made quite the prank though. Because by just viewing my HTML page, they thought their computer (in the lab) was infected. :p

I'm kind of amazed when people know Linux programming, how to compile from source and what C++ is. and still can ask how hard is it to create a virus. :p :p :p I think I said too much, but you get the idea.

C) You mean wine? Maybe wipe out data the own user has permissions to, if it know whats to look for, considering such a system may be a bit dynamic. Does the virus know how to look for the users' home directory?

(I also usually like to give my users a different folder from /home/ as well)

But hardly not take over the system. Even when data is deleted, you can easily recover them, unless the virus decides to use the shred option.

Which: shredding takes a long time, will be noticed and can easily be stopped by ctrl-c. Or a kill. Where the process actually responds, and not wait 15 seconds in Windows before it decides to present you with a dialog. ;)

Talk about head in the sand syndrome!

Anyone who doesnt have antivirus installed on their system is spreading it - its that simple! Some of the comments here reflect a complete lack of responsibility to the rest of the internet community. Anyone who claims that there are no Linux viruses dont know what they are talking about! Anyone who doesnt have antivirus and at least a software firewall installed and regularly updated is just one step shy of sending a monthly check to virus programmers around the world - I cant even believe that this kind of question can even come up!

There, I said it - believe what you want, but I cant stress enough that people get their their head out of the sand, take a look around and put up a fence before sticking thier head back in.

Even though I use F-Prot antivirus, I feel that antivirus software is only as good as the current signature files and its heuristic detection routines. If a new virus gets released into the wild there might not be any antivirus protection until the antivirus software venders release new signature files. Also when antivirus software detects a virus - that means that it has already entered the PC(even realtime scanning) and hopefully the PC has not been infected yet. Also viruses can only enter the PC by the network, downloading files, web sites with malicious content, e-mail with malicious content, or removable media. So I follow the following safe guards -

1 - Properly configured Firewall
2 - All TCP/IP Ports closed to the public internet
3 - Properly configured Security
4 - Install only the software you need
5 - Keep all software up to date
6 - Download files from only trusted sources
7 - Know where you surf - use common sense and only allow java & scripts on trusted sites that really need them
8 - E-mail - Only open e-mail from sources you know and then open it as plain text only - do not open any attachments until they can be verified
9 - Scan all removable media for viruses before using
10 - Use chkrootkit, aide, and antivirus software

My PC is a standalone that connects to the internet thru a dial-up and the 10 steps above work for my configuration(but might not work for others). I am never logged on as root when I am on the internet.

Later
Bob

A) I don't really use attachments.

B) My ports are closed.

C) My Linux machine doesn't have loopholes that allow malicious code into your system without even doing anything. Spyware? Nope. It can't write to startup either, because I have good knowledge of my startup scripts.

D) I compile all my code from well-known sources. I hardly download binaries.

E) I never surf the internet as root.

etc. etc.

Therefore I see no need for antivirus software.

Just curious.....how would you know you've never had a virus if you never checked? It's kinda like saying you're not spreading HIV just because you never felt sick.

Symptoms are usually a good teller.

Unless you have a virus that lays dormant for ten years!

What's this?

Please do explain! I would love to hear how a virus that relies on Microsoft's Embedded VB capabilities could possibly spread when Linux email clients cannot and do not run VB script. No, please, enlighten me!I have seen lots of posts here saying stuff along the lines of "if you're running a mail server that will be accessed by Windows machines then you need a virus scanner". Hmmm... how very irresponsible of us!I would have to agree with you. There are Linux virii, however, so far I have seen many posts regarding Linux virii and their very small numbers.Erm, right. So, the fact that it is really quite hard for virii to propogate on Linux machines doesn't come into it? Let's just clear one thing up. A virus is just a programme. Nothing more, nothing less. It is a set of instructions for a computer to execute. With this in mind, the virus programme must be executed in order to propogate. Receiving a virus in Linux does not mean you are infected. Please, let's get the facts right.

thank you! I can just imagine open source virus programers!! ill bet their biggest problem is geting people to do the ./configure, make, make install commands.

but when you think about it, it would be excedingly hard to program a virus for linux, every distro is different, not like the massive amount of identical windows machines. why do you even think ./confgiure exists? because of the variety of linux distros and differences between them. use checksums, relyable mirrors, and common programs and you have nothing to worry about, of course use a firewall, nobody wants random internet users having access to whatever services they are runing, unless theyr a web server or something.

now im not saying that we will never need a virus scanner, as linux gains popularity, the reward for making a linux virus will increase, but as it stands now, theres not enough linux users for people to be making viruses in the quantity that windows has viruses

But now a thought jumped to mind:
What about RPM , TGZ , DEB , etc. ?
These packages take care of that issue.
Would there be a slight chance , their mechanism could be abused for spreading harmfull code?

I don't know how feasible this is, but if somehow you managed to execute a virus, could it then turn around and use a local root exploit to gain all access to the system, and fsck your system, and then replicate (or vice-versa.)

ok, but even with that, every distro is different, and a RPM for one distro might not work for all RPM enabled distros. Now when you look at linux's market share (under 5%) and then you cut out all distros that that virus wont work on (probably near 80%) you come to a virus that works on 1% of the computers in the world (and thats generous)
(also, the virus writer would have to be carefull that a dependency check wouldnt fail :D)

and about local root exploits, with the stagering ammount of production quality kernels in existance (average of 30 per major release; 2.0, 2.2 ...) im no kernel hacker but im assuming that it would be a little more than hard to get a universally usable root exploit. not to mention that exploit fixes are extrodinarily quick to come into production.

Unless the virus is polymorphic.

But that would be a tad bulky and easy to trace.

This is something I'm particularly interested/concerned about. There seems to a large amount of software "out there" but how do I know it'll be safe to install? How do you know which are trusted sources (is there a good list of trusted sources somewhere)?

i dont on my workstations, but on my e-mail server i use clamAV

Yep...Bitdefender.com Great Linux virus checker, command line only, but smoking HOT!

BROse
U812

I noticed alot of people using the words viri or virii. However, the plural of virus is viruses. There isn't a Latin plural of virus, and besides, who speaks Latin?! But back to the topic, No I don't use any antivirus on my computer. Not in Linux anyways.

Nice app, i may use it for my own LMC Linux Media Center. If its going to work... (please help me at the Linux From Scratch forum, the message with /tools/bin/bash not found) Its handy for computo-noobies to not let them handle virus problems :) LMC is actually made for experts AND noobies unlike other distro's :P

Cya - Dazjorz

where's the "I don't use anti-virus and never did in windows either" option :p

Actually, besides a few weak Windows viruses, I haven't gotten a virus since my MS/DOS 5 days. I still have nightmares about the FORM.A virus. Man, they don't make viruses like they used to.

you know what I think is strange...

Viruses are mostly to annoy people that do not know how to get 'em away. Experts know exactly how to delete them, so viruses are kinda only for computer newbies.

But there are no computer newbies on linux! Only (normal to) expert people use linux. So why do people make viruses that will only annoy experts, but only for a small time... ?!

you shouldn't GET a virus if you don't download junk.

DaZ,

I havent thought of it like that before. When ever I go back to my parents' house, and I have to use the devil's OS, I am always amazed at how much CRAP is on it. Popups all over the place, trying to disguise themselves as dialog boxes. Viruses that don't do anything! They just sit there and throw IE windows open and take up CPU time. I think viruses are simply annoying for several reasons. One reason is because operating systems are getting more and more secure. On top of that, more people are installing firewalls, especially after SP2. More households are getting more then one computer, or they share their connection with a game system. This requires a NAT router, and they typically have cheap firewalls.

Who wants to make a virus to steal information from a crappy Windows Home Edition anyways? If they don't have virus protection installed, there is probably nothing interesting on it. If they do, the protection is too hard to break into. Good programmers have better uses for their time anyways. All the left over, bad programmers, know how to write ridiculous apps that throw IE ads up and change your active desktop.

Enough Rambling...

Llama

a friend of mine accidently formatted his hard disk and i reinstalled windows Xp for him from his official recovery cd...then within minutes of going online the antivirus started screaming it has detected the abot virus or something...i fail to understand, i am pretty sure that nothing was downloaded only SP2 was installed from a magazine Cd...can a virus execute itself from the browser? thats how secure windows xp sp2 is...

Well I meant that SP2 is secure..... As far as a M$ workstation OS goes. Compared to any other leading OS, Windows is should be called Doors... BackDoors.

If Windows is installed on a machine with a live connection to the net (e.g., an always on cable connection), studies show it will be infected within 20 minutes, even with no action taken by the user.

In other words, if you can be seen (pinged) from the net, you can (and will) be targeted.

Good thing we are Linux users... Whew...

padma - only an unpatched one.

Only if they're fowarding Junk! Sure there are a few, and it's not a bad idea to run an AV of some kind. But using some common sense about opening email, being behind a firewall, I just can't buy it...

--glenn

Granted.

But by the time you download a patch, you're infected ....