Re: [gentoo-user] Which desktop antivirus?

[James Broadhead]

I'm surprised that no one has mentioned rkhunter yet - loads of lib
exploits allow system access, and there's a pretty solid argument that says
that compromising a user account on the average *nix system allows enough
resourses to do a lot of malicious activity without even needing privilege
escalation.
On Oct 30, 2011 1:06 p.m., "Mick" <michaelkintzios@×××××.com> wrote:

> On Saturday 29 Oct 2011 19:40:49 Mick wrote:
> > On Saturday 29 Oct 2011 19:25:00 Pandu Poluan wrote:
> > > On Oct 30, 2011 1:15 AM, "Mick" <michaelkintzios@×××××.com> wrote:
> > > > pagefile.sys of a WinXP OS and it thinks it is a Win32:Patched-HO.
> > >
> > > If pagefile.sys is detected as a malware, most likely the actual
> malware
> > > was once loaded into (Windows XP's) memory got swapped, and avast!
> picked
> > > up its remnant. Loaded into memory doesn't mean that the malware was
> > > active, if the Windows XP was equipped with a good antivirus.
> >
> > Interesting!  The WinXP has Microsoft Security Essentials on it.  I'll
> ask
> > my wife if it picked up anything lately.
>
> She can't recall any MSE reports of malware.  I did check the WinXP fs for
> all
> the files and registry entries that this trojan is meant to create and none
> were present.  Then I've zero'ed the pagefile and a second scan did not
> flag
> anything up.
>
> I also checked for a reported trojan in a Windows 7 vdi file (in
> virtualbox).
> Nothing found there either.  I am tempted to think that avast! is rather
> super-sensitive.  However, avast! also picked up some php files from a
> backed
> up website - so this may be a worthwhile find.
>
> Anyway, I can't make it integrate with kmail which was the original user
> requirement.  Tried this script but the kmail Antivirus Wizard will not
> pick
> it up:
>
>   http://forum.avast.com/index.php?topic=17898.0
>
> So I am now heading for clamav to see how that works with a Linux desktop.
>
> --
> Regards,
> Mick
>