ClamAV

[dominiquec]

Just a question out there to the guys who use ClamAV: how effective is it? I tried it just now on a known infected file (from Windows) and the outcome was nil. Full details here (http://ubuntuliving.blogspot.com/2009/09/clamav-fail.html), but the essentials:

I ran the scan using the command-line tool clamscan, using the virus definitions main.cvd (released ver. 51 released on 14 May 2009 10:28 :0400) and daily.cvd (ver. 9814 released on 17 Sep 2009 13:17 :0400)

Result:

----------- SCAN SUMMARY -----------
Known viruses: 623483
Engine version: 0.95.2
Scanned directories: 8
Scanned files: 37
Infected files: 0
Data scanned: 50.70 MB
Data read: 88.91 MB (ratio 0.57:1)
Time: 9.567 sec (0 m 9 s)

However, I'm certain the files were infected with Backdoor:Win32/FlyAgent.F (based on the signatures from this ThreatExpert entry. (http://www.threatexpert.com/report.aspx?md5=aaf390e08873a12b0dc1c5a9a468f233)

Any suggestions?

[zeroseven0183]

I also thought ClamAV is a good one however, it still lacks some functionalities that you might be looking for in an antivirus (platform: Windows).

Personally, I don't use any antivirus on my laptop. Who needs that if you're on Linux, right?

But for the purpose of scanning drives plugged to Windows, I would recommend trying the online scanners of either Kaspersky (http://www.kaspersky.com/virusscanner) or NOD32 (http://www.eset.com/onlinescan/).
If you like it offline, try Avast (http://www.avast.com/eng/download-avast-for-linux-edition.html).

[bodhi.zazen]

In my experience with antivirus applications on Linux is that:

1. For the most part they generate more false positives then true virus detedction.

2. For all the hype generated by those trying to push antivirus on Linux, the linux scanners do not seem to be as good at detection as Windows antivirus nor do they have as many features.

IMO running antivirus scanners is not part of Linux security, see :

Ubuntu Security - Ubuntu Forums (http://ubuntuforums.org/showthread.php?t=510812)

Master Foo and the Nervous Novice (http://catb.org/%7Eesr/writings/unix-koans/nervous.html)

[dominiquec]

Thanks for weighing in, guys; nice to get a second opinion.