2

I downloaded a binary file from sourceforge and accidentally run it. How can I know if it is safe? I added my user to sudoers file before. Where can I submit it to scan safety?

  • 2
    Why is it that people always suspect SourceForge as being a virus-prone site? I've never once seen a virus from SourceForge. Then again, I only get reputable software from it... Did you actually run the file as sudo? – Chuck R May 3 '14 at 17:08
  • @Githlar I didn't run it as sudo but as I stated in my question, current user added to sudoers, it doesn't ask for password when I run sudo command Does it matter? – kenn May 3 '14 at 17:32
  • "user added to sudoers" and a "user added to sudoers with NOPASSWD" are two completely different things. Just a shot in the dark, but there's a very high chance that the file was not infected. What was the file? However, having yourself NOPASSWD ALL in sudoers is a very, very, very bad idea. Did I mention is was a bad idea? I would highly recommend removing that line from sudoers and replacing it with a Cmnd_Alias of only specific commands that can be executed without a password. – Chuck R May 3 '14 at 17:36
  • 1
    Virustotal.com might give you some level of certainty that the binary is save – blade19899 May 3 '14 at 18:52
2

While I cannot attest to how well it actually works, there is an open-sourced virus scanner in the Ubuntu repositories: ClamAV Install ClamAV. Once installed, run clamtk and it can scan the file.

There aren't very many AV scanners for Linux in general, but if you're willing to install non-free software you could also have a look at BitDefender Scanner for Unices

  1. Get a free key for private use here.
  2. Follow the instructions here to add the DEB repo to your /etc/apt/sources.list
  3. sudo apt-get install bitdefender-scanner-gui or sudo apt-get install bitdefender-scanner for the CLI version.
  4. Run these commands to get rid of the segfaulting behavior:

    sudo bdscan --update
    

    Read the license and, at the end, type "accept" if you agree, then (as root):

    # cat /opt/BitDefender-scanner/var/lib/scan/versions.dat.* | \
      awk '/bdcore.so.linux/ {print $3}' | \
      while read bdcore_so; do
          touch /opt/BitDefender-scanner/var/lib/scan/$bdcore_so;
          bdscan --update;
          mv /opt/BitDefender-scanner/var/lib/scan/bdcore.so \
              /opt/BitDefender-scanner/var/lib/scan/bdcore.so.old;
          ln -s /opt/BitDefender-scanner/var/lib/scan/$bdcore_so \
              /opt/BitDefender-scanner/var/lib/scan/bdcore.so;
          chown bitdefender:bitdefender \
              /opt/BitDefender-scanner/var/lib/scan/$bdcore_so;
      done
    
  5. Run the gui via the command bdgui (it should also show up in the launcher)
| improve this answer | |
  • It was this file sunet.dl.sourceforge.net/project/magnifier/… – kenn May 3 '14 at 18:34
  • You'll be happy to know that VirusTotal made no complaints about the file. See the results here – Chuck R May 4 '14 at 1:23
  • I didn't know VirusTotal checks Linux binaries. Yes, it's safe. I am not obsessive about malwares but sometimes I feel like I'm permissive about security of my system because we add many ppas to try stuff which might compromise security. – kenn May 4 '14 at 8:33
1

If you're concerned about malicious sotware on your linux machine, you're more interested in rootkits than viruses. clamav is great, but is used mainly for protecting windows machines from viruses by scanning emails before they reach the target.

You may want to consider looking into rootkit detection. rkhunter is available through apt but will give you some false positives even on a fresh install. Read about it here:

https://help.ubuntu.com/community/RKhunter

as a side note, I've never had any trouble with sourceforge, though some of my windows using colleagues occasionally download apps from the misleading ads and install things that register as potentially malicious on their virus checker.

| improve this answer | |
  • I am in trouble with installing rkhunter. I get an error message: dpkg: error processing rkhunter (--configure): – kenn May 3 '14 at 18:37
  • hmm.. no promises i can help with that. This particular install error seems to last be mentioned about 6 years ago, what version of ubuntu are you using? – N8tron May 3 '14 at 18:45
  • As suggested here cyberciti.biz/faq/… these rootkit checking programs are more accurate if ran from a live usb drive or safe system. I'd suggest a live usb drive with some storage space so you can add in the programs. – N8tron May 3 '14 at 18:48
  • I have Ubuntu 13.10 – kenn May 3 '14 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.