2

Less than 2 weeks since I installed Ubuntu and today when I ran the ClamAV it found 34 threats. They are all sorts of different threats:

Packer.PrivateExeProte
Tool.Packed
Trojen.EmbededJS
Exploit.CVE
and etc

Here a screenshot of the scan results:

Are these false positive or should I be worried? a lot of threats were found in texlive-doc folder. Should I delete or quarantine?

3
  • How did you come up with "theats" and "malware"? You may want to look up what PUA is. Apr 19, 2016 at 19:23
  • @mikewhatever the clamTK calls these results "threats" - so I used the same vocabulary
    – Nicolas
    Apr 19, 2016 at 22:55
  • 2
    @mikewhatever Don't google PUA...
    – cat
    Apr 20, 2016 at 1:23

1 Answer 1

3

All it does is scan software for specific patterns and Linux software will have those same patterns but for a totally legitimate reason where clamav incorrectly believes it found a -windows- infected file.

Regarding the 1st:ClamAV PUA.Win.Packer.PrivateExeProte-7`. As you can see not only a -windows- problem but also a "Potentially Unwanted Application". Basically something they consider a problem. When using Windows. See ClamAV PUA.Win32.Packer.PrivateExeProte-7

Regarding the 3rd see the link in comments here: Virus PUA.Script.PDF.EmbededJS-1 Again a PUA.

4th one: see ClamAV: PUA.Win.Exploit.CVE_2012_0110 FOUND (/usr/share/mime/mime.cache) Again a PUA.

Sorry, but the only thing clamav is good for is finding -windows- viruses in -windows- files. It really really really is useless on a Linux system. Even if it did ever find a virus the sheer amount of false positives makes it useless. You are wasting your time.

4
  • If ClamAV is only good for windows, is there anything good for linux?
    – meshy
    Apr 19, 2016 at 22:17
  • I thought clamav was designed for linux systems, I had a major security incident in 2004 when I was using Windows and ever since used Antivirus and they seem to be working. Moving to Ubuntu, I am afraid same thing is going to happen if I dont use antivirus.
    – Nicolas
    Apr 19, 2016 at 22:58
  • 2
    @Nicolas, ClamAV is designed for Linux servers talking to Windows clients. It's good for making sure your Samba server isn't hosting viruses, that your Postfix server isn't letting trojans through in the email, and so on. There are so few Linux viruses that there isn't really any software designed specifically to spot them.
    – Mark
    Apr 20, 2016 at 0:05
  • @meshy no, but there is also no need for it. Our security is better than windows and as long as that is the case their system is the easier target.
    – Rinzwind
    Apr 20, 2016 at 6:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .