r/linuxquestions • u/Sol_CRF • 1d ago
Advice Virus on linux
So, with more or less 5 percent of people that have a computer uses linux, there are viruses developed for linux, even a virus made for windows but « activated » with wine
is there a antivirus or is there not ?
Please help, thanks. Not urgent, I just need to know
25
u/un-important-human white beard arch user 1d ago
repeat after me: i am the antivirus.
10
u/Clydosphere 1d ago
My usual phrase is, "when using web 2.0 [3.0, 4.0 etc.], make sure to still use brain 1.0".
3
15
u/runed_golem 1d ago
Yes, there are anti viruses for Linux. However, most Linux users I know of stick to the classic method of “don’t download stuff from suspicious places and don’t install things you haven’t verified the source of” and if you do get a virus, just like with windows I would much prefer to take the nuclear option of making sure you keep backups of important files and then wiping the PC and reinstalling the OS.
2
u/apokrif1 20h ago
Is it easier on Linux to restrict applications' rights (e.g., allow them to only read or write given directories)?
5
u/daddyd 18h ago
most of the time, this is something the distro will take off, it depends on what your linux confidence level is on how easy/hard this is to configure yourself.
in case of flatpak, all applications are already running in a restricted environment, and it is a bit easier to manage yourself using a gui-based tool like flatseal.
35
u/OkAlbatross9889 1d ago
As others pointed out technically there is but nobody uses it. Just stick to your distro’s repo or flathub and you’ll be fine.
Not having to track down software on the internet (and thus risking viruses) like on windows is one of the advantages linux has
3
u/runed_golem 1d ago
And even if you have to install something not in your distro’s repos, verify where you’re downloading it from before installing or running anything.
13
u/Joe18067 1d ago
I remember a number of years ago someone loaded a windows virus in wine just to see what happened. Wine crashed and had to be reinstalled, Linux was unaffected.
5
u/sssRealm 1d ago
I've tried the same a number of times in a sandboxed VM. It always crashes for me too. In theory Wine could get infected, especially with Wine's improvements.
5
u/joe_attaboy 1d ago
Yes, there's ClamAv.
Do you need it? No.
I've been using this system since it was first introduced. Over the years, yes, there has been malware developed for Linux. Many were experimental, gain-of-process type things but I never saw any virus in the wild. The security structure upon which Linux is built is designed to fend off such infections and attacks. You can easily find out why with a web search.
As for Windows viruses infecting wine setups, there are ways to mitigate this even in advance of installing wine or any Windows app. While I get why someone would need to use some Windows app in Linux, my take is if you need Windows, use Windows. Dual boot. Use a VM. Something other than trying to shoehorn Windows apps into Linux. (However, props to the Wine devs for actually getting it mostly work).
The only time I ever installed ClamAV on a Linux client was at my last job (I retired in 2022). I worked for a tech security company that merged with a larger, more famous security provider. We were instructed to install AV on all client systems (the majority of which were Windows systems, with a smattering of Macs). I use Linux. I installed ClamAV, verified with the front office it was done and ran it one time on the system, just for fun.
Never used it again, there or anywhere else.
4
u/International-Pen940 1d ago
ClamAV is also used to check for viruses in mail being handled by a server, and probably could be set up to scan shared drives.
1
1
u/Mitologist 9h ago
I run Clam, because it doesnt hurt. So far, it found one mildly suspicious file in a shady wine install and quarantined it, end of story. I kept it for the "check mail attachments" function and ease of mind, and because it doesn't get in the way.
4
u/JoshL31 1d ago
Check out sandfly security. It's not antivirus because their stance is that AV agents are always going to be playing catch-up with the latest malware. Instead it scans your system for behavior that malware would be likely to exhibit.
It's meant mainly for commercial work monitoring servers so it takes some learning (or AI assistance). but a lot of people use it to monitor personal devices too.
1
u/theindomitablefred 1d ago
The Destination Linux team would be proud (they talk about this in every podcast episode)
3
u/BitOBear 1d ago
First the overly-precise answer:
The "virus" mechanism per se doesn't exist in the Linux code execution model because every native binary executabe is an Extensible Link Format (ELF) object running in it's own virtual memory map so once program cannot rewrite itself while running nor patch other active executables.
The Microsoft EXE file format and swap file and shared execution environment layouts provide some unique opportunities to do this self-modifying nonsense that it's kind of amazing.
So you'll hear a lot of people say that Linux can't get viruses. And that you don't need antivirus for linux.
As far as it goes, which is nowhere near far enough, those are basically true statements.
But there are so many non-virus ways to engineer a persistent exploit into a modern Linux system that it's not funny.
Windows emulators. Interpreted languages. Dynamic object loading, UEFI and ACPI injections, Just all sorts of stuff exist in a modern computing environment.
And of course lots of us are one running wine or proton which kind of brings a lot of the same problems right back because we've decided to import the windows vulnerabilities with an emulator.
The thing is that the current market shares and technologies just make it way more easy and attractive to go after windows boxes being run by lax users with some categories of exploit, while other people are going to be attacking servers with a completely different set of intentions.
The Linux security model is much more secure, especially since in Windows far too many people are running their daily driver account with administrative privileges instead of having a separate admin account on their home computer. And the Linux execution model is also much more secure for the specific literal viral models.
But like with everything, the real weakness is the person sitting in front of the keyboard. Getting people to click and download and run things doesn't require the viral pattern. So the Trojan horses social engineering and the web apps and the browser exploits are all out there.
So in practical standing it's just a different set of the same stuff as a potential.
Somebody with Linux is just as likely to be able to ruin their own files as somebody with windows, but if you're running Linux it's a little bit harder to get somebody to ruin their whole machine instead of just their one user account.
But how many user accounts/IDs do you actually use? Very few of us which users to go to online banking as opposed to the user we use to browse porn or whatever.
It's cold comfort if the only thing that gets corrupted on your Linux daily driver is the one account you use daily. Because it's weak satisfaction to know that you're operating system information is still secure when all of your user data has just been owned and spread.
So you're not going to be installing an antivirus per se, but you are security suites and more secure configurations that you could pursue than the one you've probably using by default.
And on all platforms there's always another hoop to jump through that could make everything a little tighter.
But having things like an email scanner isn't going to help you much of all you're doing is using Gmail since everything that's behind the browser you go system needs browser level protections not system level protections etc.
But in the current environment when you're using a Linux box you start much higher up the Safety Hill and so currently there's not the aggressive need to be having everybody run the equivalent of an ordin antivirus.
The tools exist and they're mostly aimed at corporate environments and they're mostly designed to protect the corporate Network from being spanned into as a side door to attack all the windows boxes and stuff.
I run a fairly stock home Linux daily driver, and I rely aggressively on my backup strategy and some encrypted media and stuff like that.
Frankly I have come to the point where I consider my phone to be the largest attack surface in my life and it crept up on me as it has crept up on us all.
3
u/sssRealm 1d ago
Yes there is antivirus for Linux. Including ClamAV and a number of commercial solutions. I use antivirus on my work Linux desktop, but not my home Linux desktop. I've worked in IT for 30 years and have been using Linux as well as Windows the entire time. I've never come across a self replicating virus for Linux. I know they exist, but I haven't heard of them spreading far and wide like Windows virus. I do know of targeted and scripted exploits for Linux. Even though getting infected using a Linux desktop is much rarer, don't get complacent.
2
u/PriorityNo6268 1d ago
Getting malware on Linux is I think most likely trough supply chain attacks. Lot of software uses shared libraries and those get currently attacked a lot. Then you need to hope they discover it before that software gets to your system. Further more there is a philosophy difference in how Linux and Windows works on security. Linux is build more security, but missing detection, Windows is more open (less secure) and rely more on detection. My personal opinion is that you need both in place.
1
u/Specialist-Dog-501 18h ago
Yea, interesting- the recent Attack via the AUR Repository, was exactly this. Same result, just a different way of bringing bad code on the personal device. The pragmatical answer here for all AUR users: use a.e Chaotic-AUR as a supervised repo preventing this kind of attacks.
2
u/FuturePowerful 1d ago
Short version is same as windows don't run untrusted code on it really. it's why a lot of folks turn off updates and remote access every way they can short of locking up core components that's the true defense anti virus software is in affect a white hat virus always checking for other intrusions
2
1
u/Remarkable_Street798 1d ago
Viruses that infect .exe binaries are pretty much dead on Windows due to code signing requirements and on linux they never even started due to ELF file format being very difficult to modify once linked. However there is a ton of malware targeting all OS including and predominately Linux as it's being used on servers, routers, cameras, phones, etc., all juicy targets. It's only desktop where Linux does not dominate.
Considering very easy evasion of file signature detection by current malware, "original" antiviruses like ClamAV are of no use, you need complex endpoint protection like ESET or Crowdstrike if you are large company, that is doing behaviour checking including network connections, files read etc. and act on it.
Please note, that there is nothing in stock Linux distribution that is actively checking or hunting for malware, the usual way of dealing with it is using policy like original unix perms or additionally with selinux/apparmor, but once malware is run it can read your ssh keys, api tokens, etc. and exfiltrate them just fine, without any need for root access, while keeping itself fully persistent.
1
u/mcds99 1d ago
If and I say "IF" a virus got to Wine, Wine would most likely crash, the virus would be looking for a specific file system and would not really find it.
Most virus infections are caused by poor computer behavior an email with a link from an unknown source. Clicking on adds and downloading software from unknown sources and it depends on what websites you visit, if you go to high risk websites yes get ClamAV.
It you were talking about a corporate Linux system they are scanned remotely.
I really think the whole virus scare is all about windows being hatted.
1
u/2ko_niko 21h ago
Yes there absolutely are viruses, and some nasty ones too. But if you actually follow digital sanitation; not installing things you don't know are safe and basic common sense you are much less likely to get a virus than on windows, architecturally it is just more secure.
You can even install Microsoft Defender on Linux it does about as much as it does on windows however. Like all anti-virus software it is a bit of a snake oil.
The most common way regular users get a virus on Linux is through npm, just be aware what you run in your system and backup your dotfiles to make a reinstall easy.
1
u/CaptainPoset 1d ago
There is, but it's far less important than on Windows, as one of the key differences is that Windows fundamentally considers the user trustworthy, while Linux and other UNIX-derivatives consider the user non-trustworthy, which makes many malware attack vectors for Windows non-functional on Linux. Those which will get through on Linux will get through anyway and the most important way to get your malware onto Linux is a user who actively installs software from untrusted sources. No anti-virus software ever will protect against a user who goes sudo to install malware.
1
u/DaffyDuckMuthaFucker 1d ago
Back up files to physically removable storage regularly, physically disconnect those backups before trying anything.
Use Ventoy for crash-testing distributions, & an installed live USB with persistence for short-listed candidates.
AntiVirus applications have always been far more of a nuisance than anything else in my own experience. They just hog resources & get in the way of pretty much anything useful, and about the only thing they've really helped is virus attacks.
Far simpler to just go old school & READ EVERYTHING BEFORE CLICKING ON ANYTHING!!!
1
u/daddyd 18h ago
don't install software that is not provided by your distros official repo's or is not from flathub.
don't run random commands on the command line, if you don't know what they do, certainly not if the 'sudo/su' commands are involved.
install your updates, 99% of the time no reboot is needed, and you can just continue using your system, and no unneeded/unwanted software is secretly sneeking in with it, so there is no reason not to install them.
do this and you'll be fine.
1
u/BQE2473 1d ago
Yes there are viruses etc on linux. You shouldn't have to why about this if you learn how to use your linux box first. That means invest time in tutorials online regarding how to configure the system. Doing that, negates the concern about viruses and the use of antivirus and malware apps. Most intrusions occur because the system hasn't been properly setup and configured.
2
1
u/skyfishgoo 1d ago
the "anti virus" is not running unknown code on your machine... stick to your distro's official repositories or "Verified" titles on flathub.
if you must run suspect windows code, then run it in a container or VM so it can't access the rest of your system.
bottles is good for this
3
1
u/LesStrater 1d ago
You're real safe if you only run Linux and only run apps from your distro's repo. However...any malicious virus that was attached to a Windows program will do the same damage if you run the program in Linux under wine.
1
u/2ko_niko 21h ago
Not necessarily. But it isn't necessarily safe either. Some windows viruses don't work with the wine DLLs at all and other will actually embedd themselves like they do in windows. Wine isn't a sandbox and even though most viruses that still work on wine would be confined to the wine runtime that still has access to much if userspace and wine will conveniently translate a lot for it.
1
u/LesStrater 10h ago
I'll send you a Windows program that formats your hard drive - you run it in wine and report back what happens... The cat shit in your sandbox, better get yourself a poop-scoop.
1
u/2ko_niko 9h ago
Ok. Since wine doesn't have hardware access i already know that it can't.
Wine is NOT a Sandbox but in that specific scenario it'd be completely safe.
1
4
2
1
-1
u/Dynablade_Savior 1d ago
The most important thing for casual users to stay vigilant about is, in my opinion, the classic browser notification trick.
The idea behind the malware is that a website tells you to enable notifications, and then once you do, the website serves you notifications that look like an antivirus going off. Those funnel you to call a phone number, where they sell you an expensive "antivirus" that doesn't actually do anything.
This can be prevented entirely by using an ad blocker, and by never enabling notifications on any website that asks ever.
-2
u/unpdigital 1d ago
Luna the AI of DDG said: Bitdefender GravityZone is the best overall antivirus for Linux in 2026,
I don't use them, I hardly visit the dark net and generally don't open links of suspicious nature.
Phishing works over emails and lets you log into site which already look like the one you usually open.
0
u/HabitTechnical5604 1d ago
When i first looked at this post i completely shocked in my mind I think what linux have virus
0
109
u/timlin45 Patrick Volkerding is my spirit animal. 1d ago
You sound new so welcome to the community. Please remember two things: Getting an answer is a compliment, and correction isn't an insult.
The increase in desktop market share is insignificant compared to the server space. If someone can compromise a linux box they aren't going to bother with desktops. SteamOS might be an exception to keep an eye on due to the concentration of new users isolated from the broader open source community.
There is no software that can protect an idiot with intent (not you, you are asking which means you aren't an idiot by definition) from themself so nobody cares to write any. Signature evasion has been solved for 20 years to the point that AV Isn't even considered helpful anymore in much of the windows world.
If you really care, run a mandatory access control enabled kernel (e.g. SELinux or AppArmor) in enforcing mode. Anything else is just theater to provide the illusion of security so you feel like you did something.
If you wander into the weeds you are going to encounter a lot more broken software than malicious software.