Free complete protection against viruses worms software for linux

The Horde Application Framework is written in PHP, and provides the common tools a Web application requires: classes for dealing with preferences, compression, browser detection, connection tracking, MIME, and more.
The Horde Framework does not provide any significant end user functionality and it provides a base for other applications and tools for developers. You will probably want to install some of the available Horde applications, such as IMP (a webmail client), or Kronolith (a calendar).
Enhancements:
- This is a security release that fixes a cross site scripting vulnerability and improves protection against phishing attempts.

The Homage Project is yet another game inspired by Scorched Earth (or Worms if youre a Windows user). It is an homage to Monty Python.

Yet Another antiVirus Recipe is a procmail that helps to filter out a lot of the most common e-mail worms.
For some of the above (plain iframe, clsid, xml, macro) e-mail is delivered normally but gets a WARNING in subject plus its old subject ($SUB).
Some of the warnings are:
WARNING-XML-CODEBASE-OBJECT-$SUB
WARNING-CLSID-EXTENSION-$SUB
WARNING-IFRAME-$SUB
WARNING-MACRO-$SUB
WARNING-NSCAM-SCORE:$NKNGS-$SUB
Main features:
- :: base64 signatures ::
- Most of these worms are MS-Windows executables and arrive at our e-mail encoded through base64 routines. YAVR uses especially selected signatures to locate these attachments. After that it places them in a directory (/virus/) sorted by name.
-
- :: iframe html exploit ::
- Through IFrame tag a html encoded e-mail can download and execute a file from a remote http site without informing the user.
-
- :: CLSID hidden extensions exploit ::
- Attachments which end with a Class ID (CLSID) file extension do not show the actual file extension saved and viewed with Windows Explorer. This allows dangerous file types to look as though they are actually innocent files, such as JPG or WAV files.
-
- :: xml codebase exploit ::
- Usage of some xml objects allow local files to be automatically executed, regardless of the security settings on the target machine.
-
- :: generic executable trap for bat, pif, vbs, vba, scr, lnk, com, exe ::
- The rest of MS-executable files that are not caught from base64 signatures end up in a virus-could-be file.
-
- :: generic macro detection for doc,dot,xls,xla files ::
- MS-Word and MS-Excel files that contain macro commands are marked with a warning.
-
- :: generic detection for most of nigeria scam e-mails (most of them) ::
- Nigeria scam e-mail is not a virus but a big spam problem... There are many good filters that use great algorithms for spam. This is just an add-on.
Enhancements:
- new switches for quarantine or not certain e-mailsbased on some ideas by Dan Smart
- YAVRQUARANTEXE if set to ON it sends unknown executables to /virus/virus-could-be as usual if set to OFF it delivers at inbox with a warning (and the X- header ;)
- YAVRQUARANTNIG same for nigeria scam
- YAVRQUARANTPRN same for porn e-mail read instuctions inside nkvir-rc
- X- marks in headers to help your own procmail scripts
- X-YAVR: MS-EXEC (any MS executable that wasnt identified by signatures)
- X-YAVR: NIGERIA (nigeria scam)
- X-YAVR: PORN (porn related)
- X-YAVR: MACRO (containing macro code)
- X-YAVR: XML-CODEBASE
- X-YAVR: IFRAME
- X-YAVR: CLSID-EXTENSION
- X-YAVR: SENDMAIL-EXPLOIT
- some more Worm.Moodown.b aka Netsky.b signatures
- another Mimail.Q

Viralator is a Perl script that virus scans HTTP/FTP downloads request on a UNIX server after passing through the Squid proxy server.
Even when I implemented virus protection for my network email server we still continued to get the odd virus. Most of the viruses came from people using free webmail accounts like Hotmail or Yahoo and downloading the infected attachments to their machines or through downloading junk.
Rather than block access to the users I decided to look at how we could better protect the network. I looked at a couple of different products both comercial and free but they were either too expensive or did not meet my needs.
That is how Viralator was born. Viralator Proxy Virus Scanner is licenced under the GPL.
Viralator should work in any UNIX system that uses Apache and Squid servers. We have reports about successful instalations on:
- RedHat Linux
- Mandrake Linux
- SuSe Linux
- e-Smith Linux
- Slackware Linux
- Conectiva Linux
- Debian Gnu Linux
Supported Redirectors:
- Squirm
- SquidGuard
- Jesred
Supported Virus Scanners
- AntiVir
- AVP
- RAV
- Inoculate
- Sophos Sweep
- McAfee
- Trend
- Clamav
- Bit Defender (free edition)
The original concept for Viralator came from the Viromat project. Without Viromat the Viralator project would not have had a starting point. We can also thank Ralph Meyer for badgering me into releasing the script under the GPL.
Enhancements:
- Parenthesis are included on the regular expression used to validate URLs.
- The character set checking step, which was not working before last patch released, has been fixed.

CGI::Application::Plugin::RateLimit is a plugin for CGI::Application which provides protection against a user calling a runmode too frequently. A typical use-case might be a contact form that sends email.

Youd like to allow your users to send you messages, but thousands of messages from a single user in a short period of time would be a problem.

Installation:

To install this module type the following:

perl Makefile.PL
make
make test
make install

protector scans e-mail attachments in order to identify those that could (by nature of their type) contain viruses or other undesirable content, and replaces them with a warning message. Protector is designed to be used on a unix mail gateway server MS Windows clients by way of a POP3 service. Typically, protector blocks DOS or Windows executables, DLLS etc Files with double extensions like "picture.gif.exe" Visual basic (VB) scripts Word documents that contain macros unrecognised file types ... etc ...

Protector is NOT a virus scanner in the traditional sense: It does NOT scan attachments for virus signatures, but blocks or edits attachments that could contain viruses. So *.exe, *.vba etc attachments dont get through. This means that you dont have to keep protector up to date to stay protected against the growing tide of new viruses and worms.

Protector does not work by blocking listed types, but by blocking a set of listed types.

The logic employed by protector to determine the file types contained in attachments is based on a modified version of the "file" command, and a number of type-specific validation programs - it does not rely on the actual name of the file, or the "content-type" declared in the attachment header. It also looks inside ZIP, TAR and other archive formats, and checks the files contained in them.

Some types of files are allowed through only under certain conditions. The main example being that MS Word documents are blocked if they contain ANY macros, but allowed through otherwise.

Protector grew out of a need to protect a small network that I manage in my spare time from the dangers of e-mail borne viruses and trojans. A number of installations exist round the world and feed back from users has allowed me to improve the system - in terms of reliability, performance, ease of use and the breadth of file types "allowed through". Development is still underway, and a new release will be available shortly that allows a far larger set of file types through, allows scripts to be removed from attachments (eg: JavaScript can be removed from HTML files), and is significantly easier to tailor.

Constructive critisism is warmly invited

F-Prot GUI is a graphical user interface for great (and free for individual users) command line antivirus called F-Prot.
F-Prot GUI is a very simple script but not featureless, I hope it will be useful.
For home users using the Linux open-source operating system, we offer F-Prot Antivirus for Linux Workstations. F-Prot Antivirus for Linux Workstations utilizes the renowned F-Prot Antivirus scanning engine for primary scan but has in addition to that a system of internal heuristics devised to search for unknown viruses
F-Prot Antivirus for Linux was especially developed to effectively eradicate viruses threatening workstations running Linux. It provides full protection against macro viruses and other forms of malicious software - including Trojans.
Main features:
- Scans for over 314168 known viruses and their variants
- Ability to perform scheduled scans when used with the cron utility
- Scans hard drives, CD-ROMS, diskettes, network drives, directories and specific files
- Scans for images of boot sector viruses, macro viruses and Trojan Horses