Anti-Virus for a beginner

**Dr Small** · July 5th, 2008

Basically, an Anti-virus is only needed if say you are running a mailserver or public FTP server and you wanted to do a good favor and protect your windows friends.

All anti-virus software scan for virus / trojan signatures, and windows viruses can't run on Linux anyhow (except in wine). So running a anti-virus software on Linux does not protect you from any "Social-Engineering" attacks.

**aysiu** · July 5th, 2008

Instead of wasting your time with antivirus, use strong passwords, don't install any kind of server software unless you know what you're doing, use NoScript, and don't install software from outside the Ubuntu repositories.

In other words, concern yourself with real security, not placebo security.

**Dr Small** · July 5th, 2008

Originally Posted by aysiu

In other words, concern yourself with real security, not placebo security.

You mean, Security Theater

**aysiu** · July 5th, 2008

Originally Posted by Dr Small

You mean, Security Theater

Totally the term I was looking for. I hadn't known of that phrase before. Thanks for the link.

Edit: On second thought, placebo may more appropriately describe this situation, since security theater appears to actually have some positive inadvertant or temporary security benefits and sometimes can be effective against attackers or criminals who are fooled by it. Any digital threat will not be fooled by antivirus.

I'm still grateful for the link, though. It was a great read, and now I have a new term at my disposal.

**gameryoshi600** · July 5th, 2008

You don't need an antivirus for linux. all you need is a good firewall. Read this guide on setting up a firewall.

**stalkier** · July 5th, 2008

Originally Posted by jamesrfla

I heard that thier was curently no know viruses for linux. I don't even think you can get a anti-virus for linux.

Wrong on both counts. There are a few viruses out for Linux/UNIX systems and even a couple for MacOSX.

Also there are several different AV software apps for Linux. Avast offer a free "Home" version for linux.

Not throwing this in your face or trying to prove you wrong bud. Just giving good info for you. It never hurts to have to protection just in case.

**napzilla** · July 5th, 2008

Here, this xkcd comic puts it best:

http://forums.xkcd.com/viewtopic.php...t&sd=a#p721240

**smartboyathome** · July 5th, 2008

Originally Posted by stalkier

Wrong on both counts. There are a few viruses out for Linux/UNIX systems and even a couple for MacOSX.

Also there are several different AV software apps for Linux. Avast offer a free "Home" version for linux.

Not throwing this in your face or trying to prove you wrong bud. Just giving good info for you. It never hurts to have to protection just in case.

These are all the viruses for Linux. It seems that there aren't that many, and even less in the wild. I would say catching a virus has a chance of next to nothing, so at this stage anti-virus won't matter.

**aysiu** · July 5th, 2008

Originally Posted by smartboyathome

These are all the viruses for Linux. It seems that there aren't that many, and even less in the wild. I would say catching a virus has a chance of next to nothing, so at this stage anti-virus won't matter.

The few viruses in that list that have links appear to be outdated (i.e., aren't real threats).

Bliss, for example:

Originally Posted by Wikipedia entry

Although it was probably intended to prove that Linux can be infected, it does not propagate very effectively because of the structure of Linux's user privilege system.

or OSF.8759

The virus attempts to infect all the files in the current directory recursively and if run from a root account, will try to infect all files in the /bin directory. In any case, no more than 201 files are infected in one run. Moreover the virus avoids infecting the files under /dev, /proc and all the files with a suffix ps such as in maps. The backdoor attempts to listen on UDP port 3049 and provides many internal commands to execute files on the target system. Upon execution, the virus tries to modify the firewall rules so that they do not interfere with the backdoor's operation. It also attempts to evade debugging by spawning a debugger itself. If the virus fails to spawn its own debugger, it assumes that the system already has a running debugger and will terminate its execution immediately.

Staog

Staog was the first computer virus written for the Linux operating system. It was discovered in the fall of 1996, and the vulnerabilities that it exploited were shored up soon after. It has not been detected in the wild since its initial outbreak.