how can I know if a binary is malicious?

Question

I downloaded a binary file from sourceforge and accidentally run it. How can I know if it is safe? I added my user to sudoers file before. Where can I submit it to scan safety?

Answer 1

While I cannot attest to how well it actually works, there is an open-sourced virus scanner in the Ubuntu repositories: ClamAV . Once installed, run clamtk and it can scan the file.

There aren't very many AV scanners for Linux in general, but if you're willing to install non-free software you could also have a look at BitDefender Scanner for Unices

1. Get a free key for private use here.
2. Follow the instructions here to add the DEB repo to your /etc/apt/sources.list
3. sudo apt-get install bitdefender-scanner-gui or sudo apt-get install bitdefender-scanner for the CLI version.

4. Run these commands to get rid of the segfaulting behavior:

   sudo bdscan --update
   

   Read the license and, at the end, type "accept" if you agree, then (as root):

   # cat /opt/BitDefender-scanner/var/lib/scan/versions.dat.* | \
     awk '/bdcore.so.linux/ {print $3}' | \
     while read bdcore_so; do
         touch /opt/BitDefender-scanner/var/lib/scan/$bdcore_so;
         bdscan --update;
         mv /opt/BitDefender-scanner/var/lib/scan/bdcore.so \
             /opt/BitDefender-scanner/var/lib/scan/bdcore.so.old;
         ln -s /opt/BitDefender-scanner/var/lib/scan/$bdcore_so \
             /opt/BitDefender-scanner/var/lib/scan/bdcore.so;
         chown bitdefender:bitdefender \
             /opt/BitDefender-scanner/var/lib/scan/$bdcore_so;
     done
   

5. Run the gui via the command bdgui (it should also show up in the launcher)

Answer 2

If you're concerned about malicious sotware on your linux machine, you're more interested in rootkits than viruses. clamav is great, but is used mainly for protecting windows machines from viruses by scanning emails before they reach the target.

You may want to consider looking into rootkit detection. rkhunter is available through apt but will give you some false positives even on a fresh install. Read about it here:

https://help.ubuntu.com/community/RKhunter

as a side note, I've never had any trouble with sourceforge, though some of my windows using colleagues occasionally download apps from the misleading ads and install things that register as potentially malicious on their virus checker.