Roundup Antivirus software Antivirus software Roundup Every month we compare tons of software so you don’t have to! ClamAV 0.95.3 ClamTk 4.21 KlamAV 0.46 Antivirus software Hoping to stay healthy, Nick Veitch gets forensic on the available programs. How we tested... Although we advocate reading all the documentation and taking care with config files, for this test we’ve done as little tuning of the software as possible – the defaults should be good enough to keep a computer safe. We employed the virus test suite, as developed by EICAR (www.eicar.org/anti_virus_test_ file.htm), the European security organisation. There’s nothing tricky here; effectively it’s just a pseudo-viral text string that should be easy for all the scanners to pick up. It’s provided in several formats, including plain text and Zip files. To complicate things further we included a few large RAW photos, plus the virus test files encoded in a tarball and hidden within an ISO image. Our retty much every Linux user thinking that Linux is immune is that For the most part, we expect virus selection thinks they’re immune to sooner or later, something like this checkers to run without us noticing that viruses, but they’re wrong. happens, and you’ll have no protection. they’re there, to consume no resources AVG Free p31 Just recently, malware was Yes, 99% of the time you won’t need it. and just get on with things. Extra points Avira Antivir P Pro p31 found hidden inside an innocuous- Maybe even 99.9% of the time. But if a are awarded to software that comes ClamAV p32 looking Gnome theme from a reputable virus checker saves you just once a close to this ideal, while they’re Sophos p32 site. Users who installed the theme also year, we think that’s a good enough deducted for difficult installs, weak ClamTk p33 got several scripts installed as root that reason to install one. documentation and poor performance. Avast p33 were designed to attack internet Of course, there are other good Many of the clients on test make use BitDefender p34 targets, but it could easily have been reasons, not least that you don’t want to of Dazuko, which is a kernel module much worse. You see, the problem with be blamed in the flame-fest that would designed to give on-access notifications result if you accidentally forwarded a to userland software – so when you virus to your Windows-loving friends. open a file, the module passes the “You don’t want to be For seconds, even if the virus doesn’t details to any service that wants to blamed for forwarding a affect you, wouldn’t you at least like to know. Some of the checkers rely on an know that it had somehow made its old version of Dazuko; we’ve made a virus to your friends.” way on to your precious Linux box? note of these in the review text. 30 LXF128 February 2010 www.linuxformat.com LXF128.round 30 14/12/09 11:48:17 am Roundup Antivirus software Antivirus software Roundup AVG Free Long-established virus scanning provided free for Linux. roducts bearing the AVG name of being thorough. Surprisingly, the have a reasonable history in software failed to find the zipped Pantivirus software, stretching versions of the virus test file. Since the back to 1992. Linux/Unix systems were test file has been around for years, this only added to the lineup in version 7.5 is pretty inexcusable – it shouldn’t be at and now lag behind the Windows all hard to find. The only reasonable version (at 9.0), having only had a few explanation is that perhaps the updates. Installing the free client is software is misconfigured. As part of pretty straightforward, no matter what our tests, we do the minimum amount system you’re using, because there are of configuration to get the program to packages freely available in RPM, Deb run. In a production environment, you and tarball formats. Installing the tarball might want to investigate the docs and might be a slight pain, but as it’s binary, the various settings, but even if you did, there’s no need to worry about AVG Free’s documentation is scantier compiling this, that and the other. than a minuscule bikini. AVG Free isn’t Unlike many of the apps here, Because of the difficulty in making well-documented Verdict there’s no GUI for this software. It’s sure the system is configured and or easy to set designed to be run as a system working, as well as the poor results in up, but it works, AVG Free some of the time. daemon to scan your files on schedule finding viruses, this wouldn’t be one we Version: 8.5 Website: http://free.avg.com or on demand. There’s an option for could recommend for desktop use. Price: Free on-demand checking with the Dazuko It performs so poorly and comes kernel module. Starting the daemon is “In terms of speed, AVG with such minimal documentation easy if you have some sysadmin skills, that it’s not worth it, even if it is free. and it can be configured to run at boot. did well, at the expense In terms of speed, AVG Free did pretty well, but perhaps at the expense of being thorough.” Rating 2/10 Avira Antivir Professional Command line scanner with a really low overhead. vira Antivir, if you can get past believe that nothing had happened, but the avoidably ugly name, lives in the scanner identified all of our infected Athe shady realms of the files and offered to quarantine them. command line, though it needs no real The default settings seem good knowledge of Bash to install or use. enough and the virus database is kept Download the archive and run the well up to date, so you needn’t fear that install script within to set everything up. you need to be extra vigilant in the There follows a series of questions configuration. It works impressively about which options are to be installed, quickly – it’s just a shame that the whether to use the scan-on-access on-access scanning isn’t available for service (which requires Dazuko) and modern kernels. where you’ve put your keyfile. The latter Avira does have free versions of its was the only hitch on installing. For other antivirus software, but all the reasons still unclear, the website Linux versions come under the It’s impressive provided us with a trial key, but it didn’t Professional department, so there’s no in speed and low Verdict work. If you have the same problem, dispensation if you’re a non-business resource use, but pretend you live in the USA… user. That said, the licensing structure not really in the Avira Antivir Professional Once we had it installed, we noticed doesn’t make it expensive: £25 for a results stakes. Version: 3.0.5 the presence of a configuration file and year-long single-user licence. Website: www.avira.com Price: £25 daemons automatically being installed Pretty average all-round, and not to run the software on startup. Running “The website provided worth paying for when there are the test scan was surprising – the better alternatives out there. software seemed to be instantaneous, us with a trial key, but and barely took up any memory or CPU cycles at all. It would have been easy to it didn’t work.” Rating 5/10 www.tuxradar.com February 2010 LXF128 31 LXF128.round 31 14/12/09 11:48:17 am Roundup Antivirus software Antivirus software Roundup ClamAV Flying the flag for open source antivirus software. lamAV was originally developed to scan at regular intervals or watch as a mail scanner, and there are certain places. Like some of the other Cplenty of configuration options software included here, it can be and tools for integrating it into your configured to offer on-access scanning local mailserver. For the same reason, it (including, thanks to it being open also supports a lot of archive formats source, support for the latest version of that are commonly used for email Dazuko) and there’s useful guidance on attachments, though some of these how to enable this on the ClamAV site. may have been disabled if you installed The major disappointment with ClamAV through a distro package. ClamAV was its failure to scan the ISO It isn’t complicated to compile, since image file properly. This was a bit the source is well documented, doesn’t confusing, because the software did have a great deal of demands in terms once support ISO file scanning, though of third-party libraries and gives you the a search through the documentation Compiling opportunity to ensure the options you now reveals no clues. As we had a ClamAV yourself want are installed. testing policy of using defaults, it would enables you to Verdict Once installed, ClamAV consists of have been unfair on the other software get the features two main parts. Clamscan is the to mess around too much. Suffice to you want. ClamAV command line tool to scan whatever say, there didn’t seem to be a simple Version: 0.95.3 Website: www.clamav.net you point it at. As with most commands, way of getting this to work. Price: Free there’s a host of switches to control This gets great kudos for being behaviour and, among other things, this open source, but loses points for accounts for its versatility.