Free bitdefender antivirus software for linux

KBitdefender project is a GUI for Bitdefender.

Translation: German, Englisch (autodetectet).

You must Make a link to Bdc in /home/user/bin

Yet Another antiVirus Recipe is a procmail that helps to filter out a lot of the most common e-mail worms.
For some of the above (plain iframe, clsid, xml, macro) e-mail is delivered normally but gets a WARNING in subject plus its old subject ($SUB).
Some of the warnings are:
WARNING-XML-CODEBASE-OBJECT-$SUB
WARNING-CLSID-EXTENSION-$SUB
WARNING-IFRAME-$SUB
WARNING-MACRO-$SUB
WARNING-NSCAM-SCORE:$NKNGS-$SUB
Main features:
- :: base64 signatures ::
- Most of these worms are MS-Windows executables and arrive at our e-mail encoded through base64 routines. YAVR uses especially selected signatures to locate these attachments. After that it places them in a directory (/virus/) sorted by name.
-
- :: iframe html exploit ::
- Through IFrame tag a html encoded e-mail can download and execute a file from a remote http site without informing the user.
-
- :: CLSID hidden extensions exploit ::
- Attachments which end with a Class ID (CLSID) file extension do not show the actual file extension saved and viewed with Windows Explorer. This allows dangerous file types to look as though they are actually innocent files, such as JPG or WAV files.
-
- :: xml codebase exploit ::
- Usage of some xml objects allow local files to be automatically executed, regardless of the security settings on the target machine.
-
- :: generic executable trap for bat, pif, vbs, vba, scr, lnk, com, exe ::
- The rest of MS-executable files that are not caught from base64 signatures end up in a virus-could-be file.
-
- :: generic macro detection for doc,dot,xls,xla files ::
- MS-Word and MS-Excel files that contain macro commands are marked with a warning.
-
- :: generic detection for most of nigeria scam e-mails (most of them) ::
- Nigeria scam e-mail is not a virus but a big spam problem... There are many good filters that use great algorithms for spam. This is just an add-on.
Enhancements:
- new switches for quarantine or not certain e-mailsbased on some ideas by Dan Smart
- YAVRQUARANTEXE if set to ON it sends unknown executables to /virus/virus-could-be as usual if set to OFF it delivers at inbox with a warning (and the X- header ;)
- YAVRQUARANTNIG same for nigeria scam
- YAVRQUARANTPRN same for porn e-mail read instuctions inside nkvir-rc
- X- marks in headers to help your own procmail scripts
- X-YAVR: MS-EXEC (any MS executable that wasnt identified by signatures)
- X-YAVR: NIGERIA (nigeria scam)
- X-YAVR: PORN (porn related)
- X-YAVR: MACRO (containing macro code)
- X-YAVR: XML-CODEBASE
- X-YAVR: IFRAME
- X-YAVR: CLSID-EXTENSION
- X-YAVR: SENDMAIL-EXPLOIT
- some more Worm.Moodown.b aka Netsky.b signatures
- another Mimail.Q

samba-vscan provides on-access scanning of Samba shares with ClamAV (clamd and libclamav), F-Secure AV, FRISK F-Prot Daemon, Kaspersky AntiVirus, OpenAntiVirus.org ScannerDaemon, mks AntiVirus, NAI/McAfee VirusScan, Sophos Sweep (via Sophie), Symantec AntiVirus Engine (via ICAP), and Trend Micro (via Trophie). It supports Samba 2.2.x/3.0.x.
samba-vscan currently is made of ten Samba VFS modules:
vscan-fprotd - for use with F-Prot Daemon
vscan-icap - for use with an ICAP anti-virus service, currently only Symantec AntiVirus Engine 4.x is supported (this is alpha code and not yet for production environment!)
vscan-kavp - for use with Kaspersky AntiVirus (kavdaemon) via Kaspersky KAV client C library. vscan-kavp is a stripped-down version from vscan-kavp of Ries van Twisk). For the full-featured version please see http://www.rvt.dds.nl
vscan-mks - for use with mks32 via mks_vir Daemon
vscan-oav - for use with OpenAntiVirus.org ScannerDaemon
vscan-sophos - for use with Sophos Sweep via Sophie (http://www.vanja.com/tools)
vscan-trend - for use with Trend Micro FileScanner / InterScan VirusWall via Trophie (http://www.vanja.com/tools)
vscan-clamav - for use with Clam AntiVirus Daemon (clamd) or libclamav (http://www.clamav.net)
vscan-nai - for use with NAI/McAfee uvscan
vsan-fsav - for use with F-Secure AntiVirus (daemon)
vscan-symantec - for use with Symantec Anti Virus Engine Note: the vscan-symantec odule will statically linked against the symantec library. This lib is not covered by GPL and the resulting vscan-symantec VFS module may infringe the GPL of Samba! Due this reason, the vscan-symantec module will only be build if --with-symantec flag is used for ./configure
Enhancements:
- NEW, VERSION, ChangeLog: updated
- icap/vscan-icap.c: bugfix
- Released samba-vscan 0.3.6b
-

F-Prot Antivirus security software package has various components that help keep your system secure from viruses, backdoors, trojans and other malicious programs. The project includes the RealTime Protector, a memory-resident monitoring utility that observes all files accessed on your system, a Scheduler where you can set the Scanner to make automatic scans or updates on your system at any time and an Updater to manage all signature updates.
For home users using the Linux open-source operating system, we offer F-Prot Antivirus for Linux Workstations. F-Prot Antivirus for Linux Workstations utilizes the renowned F-Prot Antivirus scanning engine for primary scan but has in addition to that a system of internal heuristics devised to search for unknown viruses
F-Prot Antivirus for Linux was especially developed to effectively eradicate viruses threatening workstations running Linux. It provides full protection against macro viruses and other forms of malicious software - including Trojans.
Main features:
- Scans for over 191534 known viruses and their variants
- Ability to perform scheduled scans when used with the cron utility
- Scans hard drives, CD-ROMS, diskettes, network drives, directories and specific files
- Scans for images of boot sector viruses, macro viruses and Trojan Horses
F-Prot Antivirus for Linux Workstations is FREE for use by personal users on personal workstations

Antivirus Scan with F-Prot is a simple servicemenu for konqueror that allows to scan single or multiple files and folders using the F-Prot Antivirus. Antivirus Scan with F-Prot shows the result of the scanning in a textbox using kdialog. It can also show the progress of the scanning in a terminal.
I hope you may find it useful.
Comments or/and translations are welcome.
TO INSTALL: extract the content of the tarball and copy the file f-prot_virus_scan.desktop into ~/.kde/share/apps/konqueror/servicemenus (just for your user) or in /usr/share/apps/konqueror/servicemenus, /opt/kde/share/apps/konqueror/servicemenus... etc, depending on your distro, to make it system-wide.
This is only the service-menu, you need to have F-Prot antivirus installed on your system.
Enhancements:
- Added Danish translation by Kefeus

The Qmail virus scanner (QScan) is a mail filter for Qmail that scans incoming messages using the Sophos Antivirus engine, immediately rejecting infected content.

It is designed to be minimalistic, yet extremely fast and secure, and uses multiple pipes instead of the traditional temporary files and privilege separation. It works with non-native versions of the virus scanner like under OpenBSD with Linux or FreeBSD emulation.


You must create a temporary directory to extract MIME attachments, and replace Qmails original qmail-queue program with Qscan. Quick way to achieve this for the impatients :

mkdir /var/qmail/qscan
chmod 700 /var/qmail/qscan
chown qmaild:qmail /var/qmail/qscan
ln /var/qmail/bin/qmail-queue /var/qmail/bin/qmail-queue-old

Now, lets compile and install Qscan :

./configure --help

./configure [your beloved flags]

make install-strip

The last step is to replace the original qmail-queue program with our filter :

rm /var/qmail/bin/qmail-queue
ln -s /usr/local/sbin/qscan /var/qmail/bin/qmail-queue

Depending on your local configuration, it may be needed or not, but start with doing it :

chown qmaild:qmail /usr/local/sbin/qscan
chmod 6711 /usr/local/sbin/qscan

After testing, if everythings ok for you, remove the setuid bit :

chown 0:0 /usr/local/sbin/qscan
chmod 711 /usr/local/sbin/qscan

Endian Firewall is a "turn-key" linux security distribution based on IPCop that turns every system into a full featured security appliance. Endian Firewall has been designed with "usability in mind" and is very easy to install, use and mange, without loosing its flexibility.
The features include a stateful packet inspection firewall, application-level proxies for variuos protocols (HTTP, POP3, SMTP) with antivirus support, virus and spamfiltering for email traffic (POP and SMTP), content filtering of Web traffic and a "hassle free" VPN solution (based on OpenVPN). The main advantage of Endian Firewall is that it is a pure "Open Source" solution that is commercially supported by Endian.
Main features:
Based Module:
- Firewall (statefull inspection)
- Outgoing Firewall
- IPSec Gateway to gateway VPN
- IPSec Remote client to gateway VPN (roadwarrior)
- NAT
- Multi-IP address support (aliases)
- Dynamic DNS
- DMZ support
- HTTPS Web Interface
- Detailed network traffic graphs
- View currently active connections
- Event log management
- Log redirection to external server
- Server DHCP
- Server NTP
- Traffic Shaping / QoS
- Transparent POP3 antivirus/antispam proxy
- Transparent HTTP proxy
- Web Proxy with local users, windows domain, samba, LDAP, radius server management
- Intrusion Detection System
- ADSL modem support
- Configuration backup and restore
- Remote update
Advanced Antivirus Module:
- HTTP Antivirus
- Endian Security Tools for Windows Desktop
- Transparent SMTP antivirus/antispam proxy
VPN Gateway Module:
- Gateway to gateway VPN with OpenVPN (http://openvpn.net/)
- Remote client to gateway VPN (roadwarrior) with OpenVPN (http://openvpn.net/)
- Bridged and Routed VPN mode
- Endian Client VPN ? Windows, Linux, MacOSX
Web Content Filter Module:
- URL filter
- Web content analysis/filter
- Whitelists and blacklists management
- Web surfing time limits
Enhancements:
- SATA support is now again working
- A wizard after installation asks to set the passwords (root, admin)
- Added possibility to restore a backup directly after installation
- Fix for blocking incoming connections coming in through the VPN [#210]