Re: free spyware and virus checker for Linux?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

J.O. Aho schrieb:
Hendrik Meinert wrote:
J.O. Aho schrieb:
Umma Gumma wrote:
Is there such an animal? A free spyware and virus checker for Linux?
There are a number of virus checkers for Linux, but as long as you don't
run a mail server and have users who uses microsoft whom you want to
protect from getting viruses attached to the mails, you have no use of
the virus programs (scanning the Linux box with them will just generate
a good number of false positives).

that isn't true! There are a few viruses written for Linux. See
http://www.codito.de/text/linviren.html (German)

Sure there are exploits to use in Linux too, but those anti-virus programs
will anyhow generate a load of false positives and generating a lot of false
positives will mean that the program in question is useless for scanning a
Linux system, they are mainly ment for mail scanning and 99.999% of those
viruses in mail are for microsoft systems.

I wouldn't call those examples on the German page for viruses, then you would
class the following script as a virus:

#!/bin/sh
cat /dev/urandom > /dev/hda

It's quite harmless to run as a normal user, but as a root it can lead to that
you have to reinstall the whole system. The script itself won't sit and wait
for another file and infect it.



or, for examples of Linux viruses,
http://search.mcafee.com/search?q=Linux&site=us_site.Virus&num=10&sort=date:D:L:d1&output=xml_no_dtd&proxystyle***=default_frontend&client=default_frontend&getFields=description&ie=UTF-8&oe=UTF-8&filter=0&;
(English)

Those pages listed there only contains Linux exploits, still not a program
that will multiply itself without help of a person who takes advantige of the
exploits.


If you want to keep your linux box "virus free", then you have better tools
like rkhunter and chrootkit.



As far as I know, rootkits are used to hide a virus or anything
potentially unwanted software.

You also said, such a program would generate lots of false positives. I
am using a anti-virus scanner. A few days ago, I put a little set of
viruses into my home directory. The anti-virus scanner found them all
but didn|t generate much false positives, only a few set of archives,
that were too big.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGXWpFT1P679cL/XARApGKAJ9uWH86BKbHvRiMKklsfkSFA0XlGgCfcbP2
z4zGpe0i0wPd8fKfSQfhWrg=
=cMPU
-----END PGP SIGNATURE-----
.

Quantcast