Best free Antivirus program for an Ubuntu VM

[sam64]

Hi. I'm planning to explore the deep/dark web, but I'm taking the necessary precautions first (using a virtual machine, a VPN, and an antivirus for the VM).

So I'm trying to figure out what the best free antivirus program would be for my Ubuntu virtual machine. The reason is because I've recently learned that VMware still relies on a so-called Internet Relay Bridge to your main host's internet connection in order for your VM to access the internet. Is there a specific antivirus program that would help with that, and that wouldn't interfere with the functionality of a VPN service provider?

[TheFu]

AV isn't all you need and AV on Linux isn't likely to help much. Viruses just aren't written for Linux much. There are sticky threads at the top of this forum which explains. Read those.

Don't use WINE.

Professional security people use different computers. Breaking out of VMs **is** possible for targeted attacks, like you will be exposing your system. Best to remove any storage that you don't want compromised - disconnect it. Unplug the sata cables.

[tnthomas]

The only AV for Linux that I know of is ClamAV. You also might consider chkrootkit or rkhunter for detecting rootkit files. They are available in Ubuntu repositories.

[9cddz&mK07%F@]

Some antivirus producers such as Avast have products for Linux. If you want your system to be 100% open source, use ClamAV.

[monkeybrain20122]

Clamav checks for Windows virus and is notoriously crappy. You don't need AV on Linux.

Edited: going to the dark web is not a usual use case, but I doubt that in this instance AV would help much if you expose yourself that way.

[monkeybrain20122]

Don't use WINE.

.

Better check with Wine HQ to avoid virus with platinum or gold rating.

[TheFu]

Better check with Wine HQ to avoid virus with platinum or gold rating.

Exactly. Linux systems have gotten Windows viruses through WINE while using other Windows programs.

My point is that looking for trouble and expecting any virtual machine to protect the OS and the hostOS is not likely to be over 70% useful. If you poke-the-lion, your odds drop 25% more. There are just so many attack vectors available today.

If I were planning to do what the OP is planning, I'd use a chromebook running a freshly loaded chromeOS with a new google account or just the guest account. The running OS on chromebooks cannot be modified. It is part of the security for the OS. We can simulate something like that with containers under Linux, so running a VM + a container for the bad VM work is useful. Don't forget to change all the things that can identify the system too. Definitely change the MAC(s), but also the things used by super-cookies need to be changed. Using a file system overlay that gets wiped would be good too. Hard for a supercookie to remain on a system that doesn't store anything to disk.

But for most people, the easiest answer is to run from a burned CD/DVD and have no other storage connected to the computer when performing high-risk activities.

[SeijiSensei]

I don't use VMware, but the default configuration in Virtualbox hides the VM behind the host and connects with NAT ("masquerading") like many routers do. I'd be surprised to learn that VMware only allows bridged networking.

AV isn't worth your time. Just make sure you have a clean snapshot of the VM you can revert to if something goes awry.

[HermanAB]

Hmm, I would build a new system for the experiment and make a backup for easy restore. AV etc, is simply a waste of time.

[kerry_s]

there are distros built more securely than normal i suggest using 1 of those.
i have my mom on endless os which has a read only /root & apps are flatpack. never had any issues with her system since.