Virus Scanning Tools in Unix Platform

[Chris Fung]

Hi all,

Can anyone tell me what kinds of virus are commonly found in Unix platform? Since I seldom heard Unix will suffer from virus attack except from some torjan horse programs. Besides, is there any virus scanning tools can be installed in Unix platform to detect and fix the virus?

Appreciated it if you can help answering my questions and with links to related resources.

Many thanks,

Chris,

[T G Manikandan · Accepted solution]

Hello,
There are no viruses on unix platform.
The way the files can reside on the unix server is when you do a ftp or use nfs-client and transfer files from Windows to Unix.
you have some virus tools to clean it.

check www.mcafee.com for virus tools for unix.

Also check the Trend micro virus control


www.antivirus.com/products

[Michael Tully]

Hi,

Other than getting trojan horses you system can be open to exploitation if the appropriate measures are not taken.

Have a look at these links:

How to build a bastion server
http://people.hp.se/stevesk/bastion11.html

Detecting an intrusion
http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci789285,00.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0x67f9c6af36b7d5118ff10090279cd0f9,00.html

[eran maor]

Hi

from what i know you can try to find it on the open software site : http://hpux.cs.utah.edu/

but i have to say that allways , when i found on a virus it was microsoft software and not a unix software .

i can advise you what one of me site is doing on this issue , thee is a lot of microsfot software to check virus to the are using this software to scan cd-rom from virus to duble check on this issue .


here is some other que. that was on this in the past .

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x34347b8d1de3d5118ff40090279cd0f9,00.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x9f66c5ea0230d411ade80090279cd0f9,00.html

[eran maor]

Hi Again

just want to add that i can recomment on a security product call IDS that is giving you a lot on the issue of security .

it have a aduit scan for elert that you are defining and is defining for the system .

it is not an answer for a virus but mybe it will help you .

here is the link for the software that is free .
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProducts.pl?group_type=search&group_name=virus&search_free=1&search_trial=1&search_buy=1

[harry d brown jr]

Chris,

Most unix based virus scanning software is for scanning M$ (microsoft) files that reside on a unix server. It's good for scanning files that are available to M$ users, like say a samba share. The virus itself isn't going to run on the unix server.

live free or die
harry

[Bill Hassell]

As mentioned, no viruses on Unix...it is too dumb to automatically execute email attachments or follow instructions inside a word processing document.

On the other hand, it is a very mature operating system and that's both good news and bad news. The good news is that it is extremely stable with uptime measured in years, but the bad news is that it has a lot of features that should be disabled before placing a system into production.

Unix isn't unfriendly to users and sysadmins, it is just indifferent. With an appropriate amount of knowledge and sysadmin actions, it can be made quite safe. Start with a good book on security: HP-UX 11i Security, by Chris Wong. Anmd look over the Bastion Host document by Kevin Steves at:

http://people.hp.se/stevesk/bastion11.html

Both documents are primarily designed for 11.0 and higher but 10.20 is being discontinued in about a month from now and goes obsolete a year from now.

Always keep production systems up to date on patches, especially security patches. You can subscribe to the patch notification list (or just security patches) via ITRC. Click on the cryptic: More... link in the Maintenance and Support section.

[Trevor Dyson]

You can check operating system and application files that have been installed through swinstall with the swverify command.

This can show if binary and configuration files have changed their size, permissions or ownership since they were installed, possible signs of malicious tampering.

[benoit Bruckert]

I 've never found a virus on Unix, But I'm using scanner on my HP-UX server to use on microsoft workstation (network scan in the night).
I also use these scanners to check attachments in email.
To make it work (My mailserver is Unix), I'm using amavisd (www.amavis.org).
and the scanner you can use on HPUX are :
openantivirus (www.openantivirus.org),
macaffe,
sophos (www.sophos.com)
Trendmicro.