Do I need to have 'antivirus software' installed?

Question

I thought that there was no need to scan for viruses in Ubuntu or any Linux distros until I found a virus scanner package named 'clamtk' and 'klamav' in Ubuntu software center yesterday.

This leads to the following questions:

• How do viruses differ between Linux and Windows?
• How do the strategies for protection differ between Linux and Windows?
• Should a virus scanner package be installed on my system? If so, which would be a better option?

Answer 1

There are viruses for most all platforms (the first worm was for DEC VAX) , they are just more common on Windows. Different platforms are more secure than others, but a virus can typically gain user level security, which is often good enough, on most platforms. You can actually run Windows without a virus scanner if you keep it patched and are really careful.

Differences from Windows to Linux for viruses: On Linux it is harder for the virus to get root (or system) level access. But it could probably still access your address book or saved passwords in Firefox (user level access).

Strategy: If you are really careful and know what you are doing you can get away without a scanner. A good strategy is to have your scanner just scan downloads or if you are bringing a file from another computer on a USB drive or floppy disk (assuming you have one). If you want you can have it do regular full system scans too. It is all about how paranoid you are, and how likely you are to get a virus.

For your laptop I would suggest only having the scanner scan downloads and when you are brining files from another computer. Having it do full system scans can be a battery drain.

A very important element of a virus scanner is having it updated with new signatures, so pick the package that has the best signature updates, and that works best for how you want to use it.

Answer 2

Both klamav and clamtk are front-ends for the clamAV software. They do check for linux viruses, but they and are most useful for making sure your linux computer isn't sharing infected files with windows machines. Most of the virus scanners for linux are actually for servers, and are meant to scan email or uploaded files as they are sent.

Wikipedia has a list of Linux malware, which should help inform about the risks: http://en.wikipedia.org/wiki/Linux_malware . They list 30 viruses and various other possible threats.

Answer 3

You may not need a virus scanner per se, but you sure do need to keep your system up to date and secure (good passwords and system practices - permissions etc)

Personal Anecdote: I had a debian server running, It had an uptime of 400 days and I wanted to get to 500 before restarting it to update the kernel, I was being silly, and too cocky about it being a linux system . Since it was a server that served a research group, I gave all of my coworkers an ssh account. Turns out that some hacker exploited a bad password by one of my users and loaded on automated script that ran through 5 or 6 exploits before finding one that worked (an exploit that was patched, had I updated the kernel). It rooted the server and then proceeded to set up a bot (Campus IT caught the hack before I did, they noticed suspicious IRC traffic and contacted me).

Funny story, is that I used those same scripts to take back control of the machine to backup some raw data before nuking the system.

Long story short, keep your system up to date, keep your passwords secure, maintain good administrative practices. And unless you literally go and do sudo rm -rf /* because someone online told you to, it's unlikely you will ever have any trouble with your linux computer.

Answer 4

It's not needed since (contrary to popular lies), linux is rather secure, and you are unlikely to get a virus for linux. Your risk is higher that you might pick up a windows virus while running wine, or that you may get hacked by a remote user (a rare occurrence on the desktop).

My suggestion: install gufw from software center, enable your firewall, along with some optional rules if you like, and optionally install clamav as well (along with fresh-clam).

Overall, your best defense, is to be armed with knowledge. A good way to do that is to get a feed reader like liferea, and follow popular linux sites like omgubuntu or sites like /. (slashdot) for news related to linux security. Don't run software from people you don't trust (that means, be careful with shady ppa's, use software that's in the standard repos where possible, and don't run strange plugins on websites, even if it is kinda funny when they fail to infect your linux system =P)

Hope that answers your question =)

edit: viruses are the same on every system in the sense that they all try to use a vulnerability or a user's ignorance to propagate themselves or access something they should not. It's no different on linux, but linux is more secure, way more secure. The antivirus software you saw is actually mainly there to protect windows users; for example if a friend sends you an infected file, you might pass it on to a windows user without being affected yourself.

Answer 5

There are some theoretical viruses that target Linux systems (whether specifically or cross-infectors that propagate through Ms-Windows), But there has never been a documented infection of Linux programs in normal desktop use.

If you are in the habit of regularly downloading Windows programs from the internet and running them using wine, then you should get an anti-virus to scan them. You might also think about limiting your wine usage to a different user account - in case a malicious windows program (infected or otherwise) wants to destroy your user data.

Otherwise, don't bother.

Answer 6

You can try BitDefender Antivirus for unices. Its one of the best scanners ive tried with a intuitive GUI and regular updates. Unfortunately its a on demand only scanner but good for those e-mail attachments and USB Drives.

http://www.bitdefender.com/world/business/antivirus-for-unices.html

Answer 7

I am not worried about my Ubuntu gets infected with virus because I know the chances are very slim , but I have avast installed in case my windows gets infected I can clean it from Ubuntu using avast ( I have dual boot, XP and Ubuntu).

Answer 8

Its needed if you wanna scan your NTFS partitions..I use opensource antivirus clamav to scan my NTFS drives.It is awesome,but some times the result may be false positive,so be sure before you delete a file..Cheers....!

Answer 9

Speaking of all the security issues in general, but leaving out the viruses, Ubuntu has build-in security.

However, Ubuntu will not stop you from installing malware like the Windows anti-viruses try to do. For example, if someone tricks you into installing software that will spy, spam, or destroy all your data then you're out of luck.

Many more security mechanisms are available if you choose to set them up: firewall rules, anti-virus scanners, network monitoring, two-factor authentication, etc... These additional mechanisms are mostly intended for servers and you should not need to worry about them as a desktop user.

Having that said, there are many vulnerabilities and Linux systems get broken into every day all over the world. Security teams come-out with updates to fix these vulnerabilities regularly. Ubuntu has it's own security team that releases updates and advices for systems administrators.

Here is an overview about anti-Viruses and Ubuntu security.

In practice Ubuntu is much safer than Windows. In terms of exposure to malware, Ubuntu is comparable to Mac. But as @Giacomo pointed out, living in a nearly virus free world can leave Mac users naive.

The top 2 things that you can do to stay extra safe:

1. Install software only from the official repository
2. Keep your software up by letting the Update Manager do it's thing

Answer 10

A virus is computer program that writes itself to another program, which would then write itself to other programs and so on. In Ubuntu, only root is allowed to write to executables. This means that a virus would have to gain root access before it could infect your system. So even if the virus did reach your computer, it would be very difficult for it to actually infect it. It is not impossible, but difficult.

But a virus is not a virus unless it is able to actually spread. It is very uncommon for users to copy software directly between themselves. Instead, you'd download the software from the distributor, who has compiled the code from source and then signed it. First of all, this means that a virus would be incapable of spreading because it isn't being copied. But it also means that Ubuntu would actually refuse to install infected software quite simply because the certificate would no longer be valid. When you install Ubuntu from a CD, you can test the CD for errors. It's the same principle. If the software has been changed, then it is no longer valid. Whether that's because of tampering or a bad download, is actually quite irrelevant.

In other words, there are many reasons why viruses will have an insanely small chance of surviving in Ubuntu. So much that it can be considered almost impossible.

However, viruses are only one kind of malicious software. The anti-virus manufacturers like to use that expression for everything because of the fear factor. It is completely possible to make other kinds of malware, like trojans. Actually, this is a little bit easier on Ubuntu than other operating systems, using PPAs for instance, but also easier to detect. So in other words, even if Ubuntu is mostly immune to any kind of virus, it is not safe to assume that it is safe to run just any software.

Answer 11

All software platforms need virus protection. However the majority of viruses are written for Windows and will not affect Linux. However, there is till the potential of cross-platform type viruses (Flash, Java PDF, etc) that can still do some damage on any system. Also, Linux can be a "carrier" and still spread viruses by e-mail or flash memories without you knowing about it because it had no effect on you. Therefore, I recommend installing Clam (Gnome) or Klam (KDE). This does not run in the background and needs to be updated and run manually about every week or so.

Answer 12

The problem with scanning for viruses on Linux vs on Windows is that it is more trouble than it is worth. Scanning manually takes more diligence and commitment than most people have. Setting it up to scan in the background is tricky at best and impossible for most users.

So you can do it, if you have the time and patience, but for me it is wasted effort. I don't use Windows and people who do, deserve what they get, IMO. When you choose Windows, it comes as part of the package deal. When you choose Linux, you get out of all of that nonsense. The security is built in and there are few enough viruses for Linux that you can stop worrying about it.

Answer 13

to have extra protection is good practice better safe then sorry. you can also beef up your security with most web browsers.

Answer 14

Security is a matter of how you use your computer. Thinking before acting, most of the times is the best Antivirus/Malware protection mechanism.

For users coming from Windows having an Antivirus seems to be essential but they are tricked into a false sense of security. Before clicking on a mysterious link just because Bob told you that the flash video there is awesome and you just have to check it out is such a potential risk.

Always think twice before visiting a certain site or opening a certain file. If it stinks like fish it probably is fish.

Now to answer your question. No, as long as you don't plan to have Windows machines on your network or to interact with them in any way by transferring files for example then no you won't need any Antivirus. If there are Windows machines in your network or you plan to transfer files from/to such a Windows machine then to protect the Windows machine you should use one of the already mentioned Antivirus packages.

The security team is doing a great job at fixing vulnerabilities but this task is most of the times to be performed as a reaction to a certain vulnerability, just keep that in mind.