Slashdot Mirror

I'm not even going to bother linking all of these...

http://www.mcafee.com/us/products/virusscan-enterprise-for-linux.aspx
http://us.trendmicro.com/us/products/enterprise/serverprotect-for-linux/
http://www.kaspersky.com/linux
http://www.eset.eu/products/nod32-for-linux
http://www.centralcommand.com/Products/VexiraforLinux/VexiraforLinuxFileserver.aspx http://www.centralcommand.com/Products/VexiraforLinux/VexiraforLinuxSambaServer.aspx
http://www.centralcommand.com/Products/VexiraforMailServers.aspx
http://www.f-prot.com/download/home_user/download_fplinux.html
http://www.avast.com/linux-home-edition
http://www.avast.com/linux-unix-edition
http://www.sophos.com/en-us/products/endpoint/endpoint-security-and-data-protection/components/anti-virus-protection/linux.aspx?utm_source=Non-campaign&utm_medium=AdWords&utm_campaign=NA-AW-Linux
http://www.ca.com/us/Support/gsa/Virus-Info/Virus-Signature-Updates/eTrust-Antivirus-7x-for-UNIX-and-Linux.aspx
http://www.pandasecurity.com/homeusers/downloads/desktopsecure/
http://www.pandasecurity.com/enterprise/solutions/
http://www.pandasecurity.com/enterprise/solutions/commandline/
http://free.avg.com/us-en/download.prd-alf
http://download.bitdefender.com/repos/

Have there actually been any MBR "bootkits" in the wild that have used flashable BIOS for storing copies? I always though that was a malware "urban legend". And shouldn't any flashable BIOS have some sort of jumper switch to prevent unauthorized flashing to being with?

Yes there are, and the symptoms are hard to relate. It's things like the PS/2 mouse won't be detected, or the floppy drive won't work right. Had one on my desktop back in college - only virus I ever had. And yes, the only way to get rid of them. Variants of the Monkey virus do store themselves into the BIOS.

Try F-Prot corporate. http://f-prot.com/ 10 licenses/year is $50US. We had it at work for a couple of years for 20 seats at $90 /year I'm back with it after 1/2 year of Spybot S&D. It found a couple of things that ENOD32 missed. It also doesn't lag, even on old VIA Centaur cpu's.

F-Prot for Windows has a corporate version which keeps itself up-to-date. The updates are pulled automatically from a central Windows/Samba whenever it notices that a new version exists. Another nice feature is that F-Prot is a cross-platform application- the AV definitions are compatible across all versions. This is nice because the AV definitions are compatible across all OSs. I have mine setup for a Linux computer to check for new AV definitions every hour, and then share the resulting downloads with other workstations on the network. It works as advertised.

The F-Prot corporate license is available at very reasonable cost; $5/year per workstation, IIRC.

There are lots of antivirus programs for linux and a few for MAC'nix. Here is the F-prot version for linux but there are lots of stuff out there just to scan 'das mail system' so as to protect the Windows lusers. I suggest you try google next time mmm-k?

http://www.f-prot.com/products/home_use/linux/

Thanks, I'll look into avast; I wanted a free AV for virtual machines.
Personally, I would recommand f-prot. Small footprint and it saved me and friends many times.
I tried AVG, but that thing is big, complex and annoying.

Sigh, RISC as a platform strategy is not dead. PA-RISC, yes, it was abandoned in favor of Itanium, but Power, SPARC, MIPS,and ARM continue. Apple is not *the* benchmark of relevant technology, despite what they would like everyone to believe. And if you do need Apple to use something to consider it relevant, look at Apple's ARM platform iPods and iPhone.

And, more to the point, there is no relevance to security in talking about PA-RISC, or any instruction set at all. Once you hop OS, you no longer readily run Windows-compiled code anyway. Malware is just as likely to call upon a scripting interpreter as being compiled (in this day and age, most take advantage of scripting features of browsers or some other facility anyway.

In terms of Linux v. OpenBSD on the antivirus front, it doesn't really matter. The same antivirus my company forces upon my linux workstation is avalable for OpenBSD as well:
http://www.f-prot.com/news/gen_news/080225_bsdrelease.html

I'm a linux user for various reasons, but claiming that a linux platform is better than OpenBSD for complying with both the spirit and letter of this policy is silly. Both platforms have the tools that fit the description, and OpenBSD is far less likely from a philosophical perspective to give up security for convenience. Many Linux distros will embrace a new strategy before the security implications are thoroughly worked out for the sake of a feature, while OpenBSD will wait. Though not popular anymore, I remember when a handful of linux distributions had only the 'root' login, because they thought it was easy and didn't want to burden users with privilege escalation, as an example.

In any event, if the nature of the breach is obviously in no way related to compromising a computer system and rather is a more traditional way, than I doubt the bank would try to make a claim of relevance.

Having said all that, aimed at keeping the bad kids out of the lab, it is a shame that trojans, bots, viruses, etc. from all over the world will soon get into these boxes and turn them into a zombie farm or something.

The boxes can be virus scanned using f-prot with a livecd knoppix linux. (See screenshots, below)
I find that it can do that just as good as Norton AV.

You can learn more about it here...

Frisk software's F-Prot has been using hueristics for years. It's the most reliable I've found... not that I've done tons of testing, my linux boxes run clamav and f-prot...

Doing what is required is not mutually exclusive of not doing things that you DON'T want it to do. The day your machine becomes a zombie and is packed with trojans and viruses, it may still do what is required but it is also doing other things that you don't want.

Dumb is assuming that just because it does what is required that is also isn't doing something you don't want it to do.

My older machines are relatively static. Very little new software is installed on those machines, and the new stuff I *do* install is obtained from trusted sources and then scanned anyway before it's installed (as well as when it is executed each time). I also pay some attention to my firewall logs, so things like new programs calling home are quite likely to be noticed (many things show up on my IPTRAF screens).

In other words, I don't make assumptions about the condition of my machines. Even my non-Windows machines at home are monitored quite carefully.

Now, I certainly realize that not everyone is as aware of the state of their machines. However, I would guess that most of the folks who are running an older OS are also not very likely to be installing new software on those machines, expecially things like POS systems (which already do what the company needs to be done). That eliminates trojans and many traditional virus infections (file infectors), leaving only worms and macro viruses. I do acknowledge that those can represent real threats even on older platforms, but defenses still exist if one is aware of them (my F-Prot example is one of these), and systems like POS systems aren't really at risk.

Just because a product exists, doesn't mean it's up to date support. This product hasn't been up to date with current viruses for a LONG time. As I said, no one is writing virus UPDATES not virus software.

Dumb is assuming that just because you have a product, it is always going to be up to date.

F-Prot's virus and macrovirus signature files for the DOS and Win9x scanners are still updated daily by the program's author, and I have a wget runstream which updates my copies on a weekly basis. As you well know, it's those signature files which are most important when new viruses are discovered -- the scanning shell doesn't require updating in most cases.

F-Prot Antivirus for DOS Latest F-Prot signature files

Dumb is assuming the end user knows what he's doing.

While true, many of the folks I know who are running older machines fall into three categories:

* Hobbyists like myself who are aware of the risks.

* Small business owners or corporate users who are aware of the risks.

* End users or businesses who are not aware of the risks, but who only tend to engage in low-risk activities on those older OSes such as e-mail, web surfing, or running one or more dedicated applications (e.g., POS systems).

For those folks, the problems encountered by more active (but ignorant) home users are somewhat minimized.

On proprietary systems where no one else is allowed to look at the code, modify the code, patch or update? I tend to think the proprietary vendors support is a very highly regarded commodity. And you know what else? Businesses and IT departments do as well. This has nothing to do with blindly applying patches... it has to do with patches being available when no one else can patch.

We're talking about Windows 9x, which received VERY few patches or free updates from Microsoft. Don't map their current patch release practices to the reality which existed 7-10 years ago. For Win95 systems it's mostly a nonissue, and the only way to update things was to pay to

Now that I've established that you don't know what you're talking about. . .

As for:

Open Source software, which by definition is approaching perfection like 1-e**(-k*x) approaches unity, will never, ever be subject to malware

I have so much confidence in your statement that I keep a copy of F-Prot for Linux running on this box at all times. While it's a commercial product, the Linux version is free for home users.

As for Open Source approaching perfection. . . if Open Source were remotely close to perfection, I wouldn't be writing Linux tutorials for money, everything would be running a GUI from which everything could be done easily and there'd be no market for Linux tutorials.

when i still used winblows i liked fprot..simple..not a major commitment..easy to remove..and actually works to remove viruses. *not just for windows btw

http://www.f-prot.com/

$5 per PC/yr, less in volume. At >100 it goes down to $2/yr.

A bit of a clunky interface, but the users will never have to bother with it. Set it to auto-update from a server (which updates from f-prot), tell it to mail you when a virus hits the real-time scanner. Simple, cheap, fast, and effective. The updater and real-time scanner take less than 1MB memory.

Try the free trial, keep the (free) DOS scanner on a bootable CD with your tools, even if you don't buy the GUI version.

F-prot from Frisk software. http://www.f-prot.com/

I just checked, and a 60 seat corporate license with full updates would run you $240 a year.

What about a *nix firewall with antivirus software on it?

You only need that headless pentium 3 (even a pentium pro could make it!) that you are using to rest your feet ;-), plus you will be able to forget the burden of whatever "ANTI-*.* " software that wastes your precious resources.

Of course that is if you use Windows (for whatever reason, I also do it).

For the home-users I support I always install AVG-free, great package. The only disadvantage is the updater for winme/win98 stations, having to download a 2 MB updatefile a couple of times a week is a pain in the ass for people with a 56k modem. At some offices I use f-prot. Hardly any recources and I didn't have a slip-through up till now. Mcaffeee, Norton and Sophos were all memory-hoggs is my experience...

I asked Frisk whether their antivirus program would detect the rootkit. After a couple of weeks delay, they responded that they are classifying it at a security risk. It would be interesting to see what this program will detect, since it is one of the few cross-platform AV scanners. It would be most effective detecting the rootkit by booting a live cd and scanning with F-Prot for Linux.

I would test this myself, but I don't have a test XCP cd (and I don't want one.)

It would be interesting to see if F-Prot is better than this command: find . -type f | grep -i "\$sys\$"

I am worried that their is colusion about what is to be classified as a virus by AV scanners, for fear of lawsuits.

*nods* On the other hand, I just visited http://www.f-prot.com/ and http://www.f-secure.com/ and they mention that the companies were founded in 1993 and 1988, respectively - so that would suggest that they're not the same. But then, the F-Secure website *does* mention F-Prot, talking about "F-Secure Anti-Virus for DOS (F-Prot)". Could it be that they were different companies initially that merged at a later point? I seem to recall that F-Secure was formerly Datafellows, too...

Nope, FRISK Software makes F-Prot. Not sure if you're trolling or just being misinformed.

I suspect Norton 2001 may very well be one of the last decent versions of the corporate AV products. Oh well, at least there's the good ol' DOS version of F-Prot(still updated!) that works fine on Windows 3.1/95/98/ME.

Just so you know, there's about a zillion free-for-home-use Linux antivirus applications. F-prot and Panda are just two of them. Personally, I run NOD32 on both Windows and Linux, but it aint free. It's good to see McAfee with a no-setup-drama on-access scanner though.

http://f-prot.com/ is also free for non-commercial use, and is very good.

I've got one Windows machine, running 2K Pro, and hiding somewhere on it is ISTsvc.exe. Pesky little bugger. Can't seem to get rid of it, but I can keep it contained with:
AdAware
Spybot Search and Destroy
SpywareBlaster
and
F-Prot Antivirus, which actually does a good job all by itself.
I tried the Symantec Istbar removal tool, but to no avail. I might try digging around in the registry again, but last time I did that it didn't work either.

Any suggestions, anyone?

(tig)

>it's not fair to compare a vendor's distribution of Linux with a clean install of Windows XP.

Why? It's what you get on the CD that you install from.

Then compare what you'd get on a well-made restore CD from a Windows vendor.

This statement says to me you haven't used Linux in any large capacity

True... I telnet to unix at work for web/oracle development, and use FC3 at home as a hobby, XP Pro as my main. I've only had root on FC3, on two PC's at home.

But I do understand that an OS is pretty useless without apps to do things on it. And the bundles you get with Linux are much more versatile than what you normally get bundled with Windows, and you'd have to search individually for many windows apps you want to match a linux bundle.

However:

Besides, if you're talking about something someone else sets up for you then you're not talking about ease of installation.

Isn't using a distro the equivalent of someone else setting it up for you, just not actually taking the last step of installing it? Someone had to package all those non-kernel apps together, test them, and create a convenient installer. Checking boxes in the distro installation routine is like checking the boxes for additional software when ordering a Dell online. It's just a difference in the process; you get a user-customizable distro from Red Hat/Fedora, or you pay for a customized WinXP distro and installation from Dell.

I noticed you took off Adaware/Spybot. Are you honestly trying to tell me you'd drop spyware removal tools from the list of common software for Joe User?

They're actually the first things I install, off a flash memory disk, before even connecting to windows update :-) I shouldn't have removed those, but perhaps you'd choose a package from McAffee or Norton that includes security/antispyware programs.

Viruses in Linux are rare, but shouldn't you still install a virus checker, like f-prot?

I still use F-Prot. It's not free (though it's only $29 for home users), but I haven't had any problems with it. It has much less overhead than McAfee or especially Symantec. And it doesn't assume you're stupid.

The DOS version of F-Prot is a handy anti-virus that has been around since the Win 3.x days. The DOS version is free (as in beer) and runs great on DOS-based Windows (3.1, 95, 98, ME) without sucking up resources. Not many DOS apps (or even Win 3.x apps) could contain spyware if they wanted to anyway. :)

Yes it can.

But there seems to be 3 version of the ISO... (6 if you count the fact that each come in En and Fr)

As far as I can tell, these are the edition (I can read french but the info is a bit spread across the site):

GPL Edition (Which uses ClamAV)
Fr: ftp://telechargement.antesis.org/download/CHRONOMI UM-0.9.0-GPL-fr.iso
En: ftp://telechargement.antesis.org/download/CHRONOMI UM-0.9.0-GPL-en.iso

Community Edition (using F-prot)
Fr: ftp://telechargement.antesis.org/download/CHRONOMI UM-0.9.0-COMMUNITY-fr.iso
En: ftp://telechargement.antesis.org/download/CHRONOMI UM-0.9.0-COMMUNITY-en.iso

Community Edition With NTFS drivers (using F-prot)
Fr: ftp://telechargement.antesis.org/download/CHRONOMI UM-0.9.0-COMMUNITY_FULL-fr.iso
En: ftp://telechargement.antesis.org/download/CHRONOMI UM-0.9.0-COMMUNITY_FULL-en.iso

The lastest defintions for F-Prot have to be downloaded from: http://www.f-prot.com/download/
(but they can be stored in a USB key)

Voilà!
Hope it clarify things a bit...

ClamAV or F-Prot are both good virus scanners for Linux, which are free for home use (Or completely open in the case of ClamAV). Both will scan your samba shares, and can be automated in a number of ways. Both seem to be maintained and updated quite frequently.

That's nice and all (though personally I prefer F-Prot AV ), but there are very few Antivirus software products that have Chinese versions, probably because of the rampant piracy there. The real problem with Symantec's move is that I'll bet they have a monopoly over there and that it shows they have their hand in China's pants.

While I realize you are trying to be funny it's really sad how many people don't know about virus scanning tools for Linux.

http://www.clamav.net/
http://www.f-prot.com/

etc.

The summary mentions pr0n and no one thinks of the obvious! Come on: filter MSN, closed-source, etc.

But no matter how hard you try, your kids will learn about these sins in the school playground and will most probably experiment with it to look cool in front of their friends. Pretty soon, they're stuck awaiting their next fix or two to help keep the monkey off their bootsector... err... back.

Unfortunately, I have quite a history with these things so I'd look like a hypocrite (hence: posting AC). Such is the dilemma.

Like f-prot, Clam Antivirus, and Vexira Antivirus?

Kerio Personal Firewall - great software firewall, a must on any Windows box
F-Prot AntiVirus - another must have, antivirus software
Tray Wizard - extentions to 2K system tray
DAEMON Tools - mount ISO images off your harddrive to virtual CD drives
FlashFXP - FTP Client with loads of nice features
UltraEdit - must have text editor, nice features such as syntax highlighting
IrfranView - multi-format image viewer
Media Player Classic - replacement for WMP that blows it out of the water
WinRAR - multi-format archive app
PuTTY

I always install Fprot antivirus, ethereal, nmap, and gftp. Installation of linux isn't complete without these tools. I use Nmap to test the firewalls on my network, Ethereal to look for unwanted traffic or communication problems behind my router, and gFTP is a nice GUI FTP client that never seems to come with default installs. Although, Linux isn't as susceptible to virus and trojan issues, it's nice to at least have a scanner available.

AdAware, Spybot, F-prot, AVG and Antivir.

Seems like there's no software to catch them all, each have a sublist of what can be infested.

The good news is that all of them are easy to keep up to date and FREE.

Most people are confident that their lovely anti-virus
telling them "no virus found" is enough.

But most of the time, you can have 4 out of 5 Anti-virus up to date saying everything is fine
and the 5th one still finds some crapt on your lovely Windows.

F-Prot antivirus is available for free for home users, and runs on Linux, Windows, BSD, DOS and Solaris. For the Unix-based systems, there is a nice GUI front end called xfprot.

Smoothwall is a "best-of-breed Internet firewall/router, designed to run on commodity hardware, and to give an easy-to-use administration interface to those using it. Built using open source and Free software, it's distributed under the GNU Public License".

After a quick scan of some posts, here are a few programs others have recommended:

avast! 4 for Linux Currently in beta so I have no idea what the cost will be. Windows versions are $399 US for a single server.

Clam AV A GPL'd virus scanner. Looks like pretty good AV software for open-source. Definitions are updated many times a week through submissions from the community. I think I'm going to have to check this one out myself as it looks promising.

F-Prot Anti-Virus for Linux Pricing is based on number of users; $299 for 1-24, $399 25-49, $499 50-99.

Kaspersky Anti-Virus Pricing is per-user. $10.05/user for 100 users. Unfortunately, they don't have a direct page for the Linux mail server software. I had to go to the online store for pricing.

If anybody knows more, post them here.

The F-prot antivirus definitions have it, as of the 19th. They have a nice *nix scanner that can be plugged into software like qmailscanner, which can scan all incoming and outgoing messages. They also have sane per-server pricing for ISPs.

I'm looking forward to seeing how much of an impact this will make on our mail server. Currently viruses make up less than 5% of our filtered mail. The rest is spam.

I heard goatse's down, too.

Can anyone recommend a good non-symantec antivirus and software firewall?

F-prot AV and Kerio Personal Firewall are what I use on my Win box, and they beat the piss out of Symantecs offerings anyway.

For anti-virus I swear by F-Prot which IMO is a model of correctness. They also have versions for various *nix as well.

"Worse yet, if mail filters send out one message for every copy of Sobig.F received, they are in effect doubling the amount of traffic. This makes them a part of the problem, not a part of the solution."

...f-prot (www.f-prot.com) also makes a free version which i haven't tried but have seen praised

Interestingly, f-prot also makes a Linux version. Good for watching Samba shares, perhaps. I just downloaded it, though, so I'm not sure what its capabilities are.

I use No-IP.com. Within a few hours of the worm spreading they had turned off bounce notifications of virus messages. I received a total of 10 SoBig worm notifications messages, and none of the actual worm.

I think it's up to the ISP administrators to stay up to date with what is going on and to stop these sort of things in their tracks. That is why I get my email through a third party: so I don't have to deal with the bull. They have a responsiblity to their customers. I think No-IP did a great job living up to that responsibility.

Frisk has been around for a long time, I used f-prot in DOS. But I think the letter he wrote is definitely a marketing ploy. They have recently updated their site to a more modern interface and it seems they are attempting to make some kind of mainstream market pull. I have the f-prot trial on my work windows xp box and honestly, it's pretty good. Fast and stable and less intrusive than Norton AV. So it might be good for it to work out for them.

So far we've seen people mention Grisoft's AVG (which I use at home), Avast, and even F-prot for DOS - but I haven't seen anyone mention this yet

Housecall - online virus scanner-- got someone who thinks they have a virus? Just send em to this site, while it doesn't prevent viruses, it will tell you if any show up! Its good in a pinch, and if you think your current virus scanner might be missing something.

There is also the question of what if some student manages to smuggle a virus out of the lab and releases it. Does the University's liability insurance cover any potential damage the virus might cause.

Like I said though, it ultimately comes down to the student's will to pull the trigger, but considering that the University is supplying the gun...it's shaky ground.

another alternative is MailScanner with any of these AV programs
Sophos, McAfee, F-Prot, Command, Kaspersky, Inoculate, Inoculan, Nod32, F-Secure, Panda, RAV, Antivir, ClamAV, Vscan.
Installs basically as a drop in for exim, Postfix, sendmail and ZMailer.
I've been using this with sendmail and the free for personal use version of F-Prot.
it keeps the (possibly multiple) attached AV scanners updated and has internal support for SpamAssassin.

F-Prot Antivirus for Linux Mailservers which works with Sendmail Postfix and QMail.

Go Check out Frisk Software's F-PROT for Linux and FreeBSD.

Good stuff.