Clam anti-virus on Ubuntu

By Hamish Taylor
Tuesday, 06 January 2009 09:26

Opinion and Analysis

There are quite a few anti-virus packages that work with Linux, such as ClamAV, AVG, Avast!, Panda, NOD32, Avira, F-Prot, Kaspersky, eScan and Sophos. I got these names from a quick Google search and it may not be an exhaustive list. Most of those packages are proprietary, some are free and open source. Many of them charge licence fees. However, this article is about ClamAV, so lets get on with it!

Ordinarily I don't use anti-virus software on my Linux machines. If I can't get infected by viruses, trojans and spyware that is designed for Windows, and there is effectively none of this malware that is targeted towards Linux, why would I bother?

Well, sometimes I work with Windows users and have to fix their machines. Using ClamAV, I am able to scan their machines and get rid of most, if not all, of their infections. It is also useful for scanning USB keys and digital cameras and iPods.

Cameras and iPods? Huh?

When I worked in China, I fixed any number of machines that had become infected by their owners taking photos, then taking the memory cards out and plugging them into an infected photo printing machine (and most, if not all of these seem to be infected with something even in Australia. As an aside many of these photo printing machines run Windows NT4 and often don't run anti-virus software). They'd then put the memory card, now carrying lots of nasties, back into the camera and then plug that into their laptop, infecting it.

Same with iPods in disk mode. Plug it into someone's laptop or PC, get infected, then transfer the infection back to your own laptop or PC. I'd get the call when they could no longer use their laptops.

USB keys are notoriously good for this too. In fact, just a few weeks ago, while transferring a group assignment presentation file from a fellow student's laptop onto mine, I noticed that his USB key was infected. Ironically as he was an international student, it was infected with malware that I had encountered in China! I was very glad to be using Linux.

I have also read news stories that digital photo frames, being USB based, can achieve the same thing. Although the chance of infecting a second machine is pretty remote (they aren't the sort of thing that gets carried around a lot and plugged into lots of different machines), the problem with these is this: you don't change the photos often.

So for arguments sake, say your machine gets infected, then you load up some photos and leave the display frame for six months. In that time you have noticed the infection on your machine and cleaned it. But the next time that you plug in your display frame, you reinfect the machine! Yes, hopefully your AV software will now be updated, know about that particular malware and pick it up and warn you, but do you really trust it that much?

Anyway, as much as I love to discuss infection vectors...onto ClamAV and Ubuntu on Page 2