clamav and clamtk

[anonprivate]

My signature files (clamav) are up to date, but the GUI interface (clamtk (4,45)) is not.

Can someone advise regarding the updating of this interface.

Thanks

[claydoh]

You can get the latest (5.25) deb files directly from the clamtk guy
https://dave-theunsub.github.io/clamtk/
There won't be any KDE4 integration for this, though.

If you enable Ubuntu Backports, there is 5.09 available, which does have KDE 4 dolphin right-click integration

https://help.ubuntu.com/community/Ub...rts_on_Kubuntu

[anonprivate]

Thank you for responding.

I have downloaded the Debian file.

I know that if I click on the file it should install, but, do I need to remove the current clamtk file first; or, will the new files overwrite the existing files?

Happy Christmas.

UPDATE

I decided to remove the current clamtk and then install the new version.

Unfortunately, the new version would not install due to a lack of dependencies, so I have re-installed the version from the repository

Do you know if the automatic updater will update the virus signatures for clamav (in kubuntu version 14,04)?

[anonprivate]

I am wondering about the usefulness of clam on my machine.

I only have kubuntu and their utilities on my machine.

It might be best for me to remove it (clamav and clamtk) from my system.

Clam has quarantined a couple of files that I believe can be restored prior to removal.

Let me know what you think.

[jglen490]

Having clam and clamtk is not a bad thing. From time to time I install it and then later remove it. I'm not clearly convinced that it's always necessary, and on my machine its presence or absence seems to make no clear difference. It can be a resource hog, but again on my machine it is hardly ever noticeable. So for now, I don't have it.

Follow the prime principle of keeping the OS and applications up to date. The next priority for me is to avoid click-bait and be very careful where I go in that wonderful thing called the internet. When I get a an email, and it doesn't feel right, it gets trashed. It's been a long time since I've opened that offer of millions of dollars, or the needful "friend". There's a lot of information that floats around, only some of which is actual knowledge, and only a tiny fraction of which is real wisdom. Being a healthy skeptic is as important to security as any tool. You can't offload your own responsibility.

So, as long as Linux is intrinsically and relatively safe - and that may not be forever - I don't use a Linux antivirus or anti-malware.

[anonprivate]

Thank you for responding.

My version of kubuntu is version 14. I had a lot of trouble trying to install the later versions.

Although it is an older version, I do keep it up to date.

My main concern is with the existence of malware etc. The threat to security regarding online banking is most worrying.

I have noticed, on the internet, a move towards the use of anti-virus/malware programmes latterly. Previously, the advice seemed to be 'if you are using Linux, you are safe'. But, nowadays, hackers, etc. are more sophisticated and we need to ensure that we are one step ahead.

At present, I am in two minds regarding the retention of clam, and, especially, as it is resource hungry; although, I don't run it if I am doing something else (I have only 1 GB RAM).

I may retain or remove it. I would like more evidence before making the final decision.

Happy Christmas

[chimak111]

...
My main concern is with the existence of malware etc. The threat to security regarding online banking is most worrying.
...

I'm not sure that clamav and clamtk would be of any assistance while browsing if you click on dodgy links or open e-mails from strangers or if you are susceptible to social engineering.

[anonprivate]

I wonder if clam is designed to detect viruses/malware written for Linux systems; or, if it will only detect Windows viruses/malware? Presumably, there are some that are cross platform. I wonder how many?

[jglen490]

Theoretically, a Linux antivirus could help protect not only its own Linux environment, but also virii that could be passed through to Windows systems. They are designed to detect and protect a range of virus types and virus signatures. There are, at present, still very few virii that are effective in a Linux environment and so far the simple act of keeping your OS and apps up to date are the most effective defense against those few.

Some day, these facts may change and some sort of malware defense will be a routine part of the Linux existence, also. As I said before, there's nothing wrong with installing and using clam or anything else available to the Linux world. Just remember that defense requires a product that can be constantly detecting and protecting; that's the part that absorbs a lot of resources in any system. Running occasional scans is useful, but not the optimal means of protection.

[anonprivate]

Having clam and clamtk is not a bad thing. From time to time I install it and then later remove it. I'm not clearly convinced that it's always necessary, and on my machine its presence or absence seems to make no clear difference. It can be a resource hog, but again on my machine it is hardly ever noticeable. So for now, I don't have it.

Follow the prime principle of keeping the OS and applications up to date. The next priority for me is to avoid click-bait and be very careful where I go in that wonderful thing called the internet. When I get a an email, and it doesn't feel right, it gets trashed. It's been a long time since I've opened that offer of millions of dollars, or the needful "friend". There's a lot of information that floats around, only some of which is actual knowledge, and only a tiny fraction of which is real wisdom. Being a healthy skeptic is as important to security as any tool. You can't offload your own responsibility.

So, as long as Linux is intrinsically and relatively safe - and that may not be forever - I don't use a Linux antivirus or anti-malware.

I don't think that my version of clamav and clamtk can run in the background, so resource hogging is not an issue.

I was wondering why you install and remove the programme. Why not leave it installed? Is it because your version does run in the background, but you have said that this is not an issue

Happy Christmas

[jglen490]

I don't think that my version of clamav and clamtk can run in the background, so resource hogging is not an issue.

I was wondering why you install and remove the programme. Why not leave it installed? Is it because your version does run in the background, but you have said that this is not an issue

Happy Christmas

It's a choice. I don't want apt-get/Synaptic/Muon having to chase and download the signature file changes or application updates when I don't use it at all. That doesn't mean that I hunt every program that I don't use so I can uninstall it; clamav/clamtk is just easy to add and remove.

[anonprivate]

It's a choice. I don't want apt-get/Synaptic/Muon having to chase and download the signature file changes or application updates when I don't use it at all. That doesn't mean that I hunt every program that I don't use so I can uninstall it; clamav/clamtk is just easy to add and remove.

Thank you

I have the programme installed on my machine.

It should update the signature files automatically, but I can't see a way to verify this aspect of the programme?

When you use the programme do you believe that there are certain folders that should be checked for viruses?

Best wishes

[anonprivate]

You can get the latest (5.25) deb files directly from the clamtk guy
https://dave-theunsub.github.io/clamtk/
There won't be any KDE4 integration for this, though.

If you enable Ubuntu Backports, there is 5.09 available, which does have KDE 4 dolphin right-click integration

https://help.ubuntu.com/community/Ub...rts_on_Kubuntu

I am running 5.25 (after installing gnome-icon-theme-full)

The Clam guy advised installing 5.25 because he is maintaining this version. He has been very helpful and communicative.

Best wishes

[jglen490]

The more folders you have it check, the longer it will take to run. So, assuming that you never use root to access email or the internet in general, you can check your /home directory, and subs. The chances are, with that assumption, that if you find no virus infected files in /home, you're safe.

Depending on how your user is set up in groups and how the permissions are setup in your system - other than your /home, if you find an infected file somewhere in /home, your system is probably safe and all you have is some infected files, which might be fixed. If a virus somehow figures out your password for sudo use, then your system is probably not safe.

That's the problem that a virus in Linux has to figure out. If it knows your user name and your sudo password, then it can play with most directories and wreak havoc all day long. While there are some virii in the wild that try to attack Unix/Linux systems, they are generally not effective, because they can't make the connection to sudo.

Email is probably the best way for a virus to enter your system. Once the virus is in your system, it may not know what the OS is and may not be able to execute any code. It's kind of random, in most cases, as to where an infected email ends up. Probabilisticly, it will land on a Windows system, where it will start to play and have some success. That's why there are very few Linux virii and very few of those are actually successful - because they won't get to the root-permissioned files to cause the real damage.

I can't give you a recommendation to check everything because I don't know the impact on you of checking the entire Linux installation on your platform. Check /home because that's likely where a virus will land, whether from an email or from some internet link you shouldn't have clicked on. You will find that after a month or so of checking that you will find nothing - which is what I've found out the several times I've used Linux antivirus software. If you do find something and are able to kill it, at least you won't have passed it on to your Windows friends! Maybe ...

[anonprivate]

The more folders you have it check, the longer it will take to run. So, assuming that you never use root to access email or the internet in general, you can check your /home directory, and subs. The chances are, with that assumption, that if you find no virus infected files in /home, you're safe.

Depending on how your user is set up in groups and how the permissions are setup in your system - other than your /home, if you find an infected file somewhere in /home, your system is probably safe and all you have is some infected files, which might be fixed. If a virus somehow figures out your password for sudo use, then your system is probably not safe.

That's the problem that a virus in Linux has to figure out. If it knows your user name and your sudo password, then it can play with most directories and wreak havoc all day long. While there are some virii in the wild that try to attack Unix/Linux systems, they are generally not effective, because they can't make the connection to sudo.

Email is probably the best way for a virus to enter your system. Once the virus is in your system, it may not know what the OS is and may not be able to execute any code. It's kind of random, in most cases, as to where an infected email ends up. Probabilisticly, it will land on a Windows system, where it will start to play and have some success. That's why there are very few Linux virii and very few of those are actually successful - because they won't get to the root-permissioned files to cause the real damage.

I can't give you a recommendation to check everything because I don't know the impact on you of checking the entire Linux installation on your platform. Check /home because that's likely where a virus will land, whether from an email or from some internet link you shouldn't have clicked on. You will find that after a month or so of checking that you will find nothing - which is what I've found out the several times I've used Linux antivirus software. If you do find something and are able to kill it, at least you won't have passed it on to your Windows friends! Maybe ...

Thank you for the very detailed reply.

The clam guy agrees with you that scanning /Home should be sufficient.

Best wishes for the New Year