Do I really need an anti-virus?

I know...people often ask this question. and the answers I read are confusing. So I'll just start a poll.

what I do will depend on the outcome..

Running Intrepid Ibex 8.10 Desktop Edition

No you don't need antivirus software but if you install clamav it can't hurt except slow down your init by a hair.

Where's the poll? EDIT: ok, you added the poll

Short Answer: no.

Now we just wait for someone to contend "yes", and enter the usual debate about Linux security that will get moved to "recurring discussions" around the time someone incorrectly uses the term "virii" as the plural of "virus". :-)

You might be interested in these threads too:

http://ubuntuforums.org/showthread.php?t=1016407 http://ubuntuforums.org/showthread.php?t=1016721 http://ubuntuforums.org/showthread.php?t=999753 http://ubuntuforums.org/showthread.php?t=1010633 http://ubuntuforums.org/showthread.php?t=1002676 http://ubuntuforums.org/showthread.php?t=991582 http://ubuntuforums.org/showthread.php?t=991926 http://ubuntuforums.org/showthread.php?t=835084 http://ubuntuforums.org/showthread.php?t=970407 http://ubuntuforums.org/showthread.php?t=968831 http://ubuntuforums.org/showthread.php?t=953756 http://ubuntuforums.org/showthread.php?t=5875 http://ubuntuforums.org/showthread.php?t=929124 http://ubuntuforums.org/showthread.php?t=968831

and pool too:

http://ubuntuforums.org/showthread.php?t=323028

well, it is quite common topic ;)

Will this controversy ever end. What about a Defrag? Will this ever end and anti spyware?

strAlan said: No you don't need antivirus software but if you install clamav it can't hurt except slow down your init by a hair.

Clamav is consistently the lowest rated at detections and I have had lots of false alerts with it.

jrusso2 said: Will this controversy ever end. What about a Defrag? Will this ever end and anti spyware?

short answer: no

no

sigh :confused:

It is really simple: if there is a threat, then we are protecting from it. When Linux becomes so big that it becomes major target for virus writers, we will start protecting from that threat more. For example - educating users not to download and install crap.

just use synaptic. you'll be OK.

To me the biggest problem with virus and trojans is that as we attract the less knowledgeable Windows users they will give the trojans and virus permission to run and allow them to run.

Then complain the got infected. Just like OS X.

Server or Desktop?

jrusso2 said: To me the biggest problem with virus and trojans is that as we attract the less knowledgeable Windows users they will give the trojans and virus permission to run and allow them to run.

Then complain the got infected. Just like OS X.

Well, not much changes then.. But I have some optimism based on the fact that for most new users installing with Add/Remove should get easier than any downloading. At least in most cases.

cdtech said: Server or Desktop?

KDE or GNOME? Or XFCE?

wow 20 to 0

There isn't a single Linux virus in the wild, so why on earth would you need an anti-virus application?

Right now, the only thing a Linux anti-virus program does is prevent you from forwarding Windows viruses to Windows users. This is probably only useful if you're running it on a mail server.

wmcbrine said: There are no Linux viruses in the wild. Right now, the only thing a Linux anti-virus program does is prevent you from forwarding Windows viruses to Windows users. This is probably only useful if you're running it on a mail server.

Well, "don't run commands from untrusted sources" counts.

I imagine almost every Linux user knows how to copy-paste command into terminal and enter his password. This is more dangerous than any existing Linux virus, and AntiVirus won't help in this case.

Defend against threats that are actual threats. Therefore, AntiVirus is not needed, but education is.

The wiki lists 22 know viruses along with some malware and worms for Linux distributions...

strAlan said: The wiki lists 22 know viruses along with some malware and worms for Linux distributions...

Source please.

Swagman said: Source please.

Well even though the wiki list is incomplete...

http://en.wikipedia.org/wiki/List_of_Linux_computer_viruses

Truly though I find there is no need for an anti virus, only a need for general computer safety knowledge.

Meaning know where to go and not go,when to give info and not to give info,have a firewall(any os needs one), and know to not allow something you do not know about.

Here is some more info on Linux malware(oh btw malware means viruses,spyware,worms,etc..etc...)

https://help.ubuntu.com/community/Linuxvirus http://www.desktoplinux.com/articles/AT3307459975.html http://it.slashdot.org/article.pl?sid=08/01/24/1930207&from=rss

I've lurked in or participated in a lot of these anti-virus on Linux debates over the years, and I notice they seem to break down over the same basic misunderstanding.

I think in the Windows world the term "anti-virus" has become somewhat synonymous with "computer security", probably because the big name security software vendors all got their start as anti-virus companies. Also, because that's been the biggest and most blatant threat on Windows for a long time. So you buy Norton's or McAfee, and you call it "anti-virus" even though it also has port filtering, anti-malware, content filtering, root kit detection, etc.

To a lot of long-time Linux user, "anti-virus" means just that: a program that detect virus signatures. And as someone else already pointed out, there are only 22 signatures to look for (a number of which were only proof-of-concept, and most of the rest of which exploit flaws patched long ago). So, anti-virus-- not real useful.

But when you say "you don't need antivirus", the first group of people assume you mean "you don't need to take any security measures on your computer", and zealous newbies echo that as "Linux is impervious to any possible security threat EVER!", which is not true, of course.

I'd say on a Linux box, your biggest worry should be that someone hacks in and drops a rootkit on your system. For instance, I have a Linux server at work that some fool has been trying to brute force since last spring; when I found out, it was a wake-up call for me to tighten up security on my Linux servers. So I disabled ssh access to all systems except one, installed fail2ban and monitor the logs closely. End of brute force threat. Would an "anti-virus" have helped me one iota against that particular threat? Nope. Just a waste of time.

Point being, instead of applying security superstitiously, know the threat and know how to protect against it. That's not to say you should take a "default allow" stance and only block known threats, but it means you shouldn't give yourself a false sense of security by installing software that doesn't address any realistic threat to your security.

Maybe this sticky should be stickied on the Absolute Beginners section as well as the Security section...?

lykwydchykyn said: I've lurked in or participated in a lot of these anti-virus on Linux debates over the years, and I notice they seem to break down over the same basic misunderstanding.

I think in the Windows world the term "anti-virus" has become somewhat synonymous with "computer security", probably because the big name security software vendors all got their start as anti-virus companies. Also, because that's been the biggest and most blatant threat on Windows for a long time. So you buy Norton's or McAfee, and you call it "anti-virus" even though it also has port filtering, anti-malware, content filtering, root kit detection, etc.

To a lot of long-time Linux user, "anti-virus" means just that: a program that detect virus signatures. And as someone else already pointed out, there are only 22 signatures to look for (a number of which were only proof-of-concept, and most of the rest of which exploit flaws patched long ago). So, anti-virus-- not real useful.

But when you say "you don't need antivirus", the first group of people assume you mean "you don't need to take any security measures on your computer", and zealous newbies echo that as "Linux is impervious to any possible security threat EVER!", which is not true, of course.

I'd say on a Linux box, your biggest worry should be that someone hacks in and drops a rootkit on your system. For instance, I have a Linux server at work that some fool has been trying to brute force since last spring; when I found out, it was a wake-up call for me to tighten up security on my Linux servers. So I disabled ssh access to all systems except one, installed fail2ban and monitor the logs closely. End of brute force threat. Would an "anti-virus" have helped me one iota against that particular threat? Nope. Just a waste of time.

Point being, instead of applying security superstitiously, know the threat and know how to protect against it. That's not to say you should take a "default allow" stance and only block known threats, but it means you shouldn't give yourself a false sense of security by installing software that doesn't address any realistic threat to your security.

It took you close to a year to realize that someone is trying to brute force ssh? They do this to every Linux box on the net. You do need to learn some basic security.

jrusso2 said: It took you close to a year to realize that someone is trying to brute force ssh? They do this to every Linux box on the net. You do need to learn some basic security.

It didn't take me a year, they started trying since last spring. After I dealt with it, they haven't stopped, even though they can't possibly break in thanks to tcpwrapper rules. They wouldn't have gotten in anyway, because I disabled root access from the get-go (and that's the account they were trying to brute-force).

Thanks for your kind comment, though.

lykwydchykyn said: Thanks for your kind comment, though.

That's too funny. I like your write up.....

lykwydchykyn said: short answer: no

Long answer: Noooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

I recommend it if you have a Win partition that is used by others that have no idea what is going on.

jrusso2 said: To me the biggest problem with virus and trojans is that as we attract the less knowledgeable Windows users they will give the trojans and virus permission to run and allow them to run.

Then complain the got infected. Just like OS X.

Well, can you explain whether the same Trojans can run (or be saved) on both Windows and Ubuntu? Can an Ubuntu system spread Trojans and viruses even though they never allowed to run under Ubuntu? I am asking this because I am trying to figure out where my thumb drive got infected with a Trojan? I have never seen the Trojan when the drive is mounted on my Ubuntu system. But when I tried to share photos with a Windows user, her system detected a Trojan on my thumb drive. Do I have to search for this Trojan on my Ubuntu system too to prevent repeated infections of other external drives? I have used my thumb drive on another Windows system two days before, which I suspect now may be infected. But don't exclude the possibility that my own Ubuntu is spreading viruses. Do you have any comments? I guess a general question that I want to know an answer to is, When you guys say that Linux does not need an anti-virus, is this because viruses have no permission to run themselves on Linux or because there are no viruses/Trojans that get themselves saved on Linux? appreciate any comment, e.

Have you scanned the thumb drive? I would do that to make sure of this report.

Then you need to concider if security on MS boxs is your concern.