Clam anti-virus on Ubuntu

Clam anti-virus on Ubuntu

Postby Hamish Taylor » Tue Jan 06, 2009 3:26 pm

There are quite a few anti-virus packages that work with Linux, such as ClamAV, AVG, Avast!, Panda, NOD32, Avira, F-Prot, Kaspersky, eScan and Sophos. I got these names from a quick Google search and it may not be an exhaustive list. Most of those packages are proprietary, some are free and open source. Many of them charge licence fees. However, this article is about ClamAV, so lets get on with it!

Ordinarily I don't use anti-virus software on my Linux machines. If I can't get infected by viruses, trojans and spyware that is designed for Windows, and there is effectively none of this malware that is targeted towards Linux, why would I bother?

Well, sometimes I work with Windows users and have to fix their machines. Using ClamAV, I am able to scan their machines and get rid of most, if not all, of their infections. It is also useful for scanning USB keys and digital cameras and iPods.

Cameras and iPods? Huh?

When I worked in China, I fixed any number of machines that had become infected by their owners taking photos, then taking the memory cards out and plugging them into an infected photo printing machine (and most, if not all of these seem to be infected with something even in Australia. As an aside many of these photo printing machines run Windows NT4 and often don't run anti-virus software). They'd then put the memory card, now carrying lots of nasties, back into the camera and then plug that into their laptop, infecting it.

Same with iPods in disk mode. Plug it into someone's laptop or PC, get infected, then transfer the infection back to your own laptop or PC. I'd get the call when they could no longer use their laptops.

USB keys are notoriously good for this too. In fact, just a few weeks ago, while transferring a group assignment presentation file from a fellow student's laptop onto mine, I noticed that his USB key was infected. Ironically as he was an international student, it was infected with malware that I had encountered in China! I was very glad to be using Linux.

I have also read news stories that digital photo frames, being USB based, can achieve the same thing. Although the chance of infecting a second machine is pretty remote (they aren't the sort of thing that gets carried around a lot and plugged into lots of different machines), the problem with these is this: you don't change the photos often.

So for arguments sake, say your machine gets infected, then you load up some photos and leave the display frame for six months. In that time you have noticed the infection on your machine and cleaned it. But the next time that you plug in your display frame, you reinfect the machine! Yes, hopefully your AV software will now be updated, know about that particular malware and pick it up and warn you, but do you really trust it that much?

Anyway, as much as I love to discuss infection vectors...onto ClamAV and Ubuntu on Page 2



Article Link at http://www.itwire.com/content/view/22530/1162/
Hamish Taylor
 
Posts: 154
Joined: Fri Jun 13, 2008 8:54 pm

Re: Clam anti-virus on Ubuntu

Postby mdsmedia » Tue Jan 06, 2009 3:42 pm

A couple of nice, practical articles, Hamish. Thanks.

Although I knew about and have installed ClamAV you've given some good points on scanning selected files and so on that I didn't know about.
"Linux: For those who understand, no explanation is necessary. For those who do not, no explanation is sufficient."
"In a state of confusion it is very clear that nothing is as it seems."
User avatar
mdsmedia
 
Posts: 1892
Joined: Thu Jun 05, 2008 9:37 am

Re: Clam anti-virus on Ubuntu

Postby Aysgarth » Tue Jan 06, 2009 4:49 pm

I use ClamAV to scan email through Thunderbird, not for my benefit but for the benefit of Windows users with whom I interact.

For Debian and Ubuntu the method is straightforward, just go and get the clamdrib plugin and install it in Thunderbird.

MINI-HOWTO

install clamav, clam-freshclam, clamav-base and clamav-daemon .

Go Tools Add-ons in Thunderbird and get more addons. You will need to setup a Mozilla account and get the add on "clamdrib". Download to you home folder, then in Thunderbird Tools Add-ons install clamdrib-0.2-tb.xpi

open a terminal window and "sudo dpkg-reconfigure clamav-base" (or the Debian equivalent using su)

Accept all the defaults except

socket type change to TCP
IP address clamd will listen on: change to localhost

OK, restart your computer and open Thunderbird. Restarting will load clamav with the new settings and update the virus database.

Tools -> Add-ons -> clamdrib -> Preferences -> Test Settings this will confirm everything is working.

Done.

Each incoming email is scanned and a green ClamAV Staus: "CLEAN" appears in the header if each email.

It is also possible to scan from within Evolution by setting up scripts, so do a search for a solution if that is your need, but it is a bit more fiddly than Thunderbird.

Enjoy
User avatar
Aysgarth
 
Posts: 173
Joined: Wed Nov 26, 2008 3:18 pm
Location: Melbourne

Re: Clam anti-virus on Ubuntu

Postby Guest » Tue Jan 06, 2009 5:38 pm

Also, thanks Hamish for these practical articles. See, it's not that scary outside the Windows universe.

And thanks Aysgarth for how to use it with Thunderbird.

Seems easy to install, I'll give it a go.
User avatar
Guest
 

Re: Clam anti-virus on Ubuntu

Postby Bernie S » Tue Jan 06, 2009 7:11 pm

Thank you, Hamish and Aysgarth,

I've been think for a while that it might be a good idea to implement ClamAv on my Linux boxes, as a purely to avoid passing viruses on, even if they don't bother me.

Now you've saved me the trouble of even having to read documentation -- so I'm officially out of excuses...
User avatar
Bernie S
 

Re: Clam anti-virus on Ubuntu

Postby ubu-fan » Thu Jan 08, 2009 12:52 am

I use ClamAv but i didnt kno about the ClamAV-Nautilus add-on; thanks for the tip
Great Article; i never thought there was so many reasons or uses for an Antivirus on Ubuntu
User avatar
ubu-fan
 

Re: Clam anti-virus on Ubuntu

Postby guest » Sat Jan 10, 2009 2:53 am

This is great step before following these instructions: http://attackvectors.com/~/blog/index.p ... 106-085032
Combined, it should bring a windows box up clean and at no cost!
User avatar
guest
 

Next

Return to Apexing the Linux learning curve

Who is online

Users browsing this forum: No registered users and 1 guest