Free computer virus destroyer software for linux

Computer Breaker project is a network testing tool for services vulnerabilities.

Computer Breaker is a network testing tool that allows networking administrators to test if a computer is vulnerable to malicious attacks.

Using the Nessus scanner, computer-breaker scans the remote host and automatically exploits its vulnerabilities.

Milter-virus is not a virus scanner. It is a wrapper that can be used with many commercial and freely available virus scanners. Milter-Virust is written completely in C, and requires (few skills??).
It is run-able with the Milter interface, but then will only scan for "double extensions".
If you wish it to scan for more, you need at Ripmime or other tools to extract files from MIME-encoded emails. You also need a (command-line) virus scanner.
The difference between this program and the original is that this is much more configurable via the config file. The original version has the advantage that it is simpler and easier to bugfix.
Enhancements:
- This is a large update.
- Many problems in the statistik module were fixed.
- Some spam protection features were included.

The Qmail virus scanner (QScan) is a mail filter for Qmail that scans incoming messages using the Sophos Antivirus engine, immediately rejecting infected content.

It is designed to be minimalistic, yet extremely fast and secure, and uses multiple pipes instead of the traditional temporary files and privilege separation. It works with non-native versions of the virus scanner like under OpenBSD with Linux or FreeBSD emulation.


You must create a temporary directory to extract MIME attachments, and replace Qmails original qmail-queue program with Qscan. Quick way to achieve this for the impatients :

mkdir /var/qmail/qscan
chmod 700 /var/qmail/qscan
chown qmaild:qmail /var/qmail/qscan
ln /var/qmail/bin/qmail-queue /var/qmail/bin/qmail-queue-old

Now, lets compile and install Qscan :

./configure --help

./configure [your beloved flags]

make install-strip

The last step is to replace the original qmail-queue program with our filter :

rm /var/qmail/bin/qmail-queue
ln -s /usr/local/sbin/qscan /var/qmail/bin/qmail-queue

Depending on your local configuration, it may be needed or not, but start with doing it :

chown qmaild:qmail /usr/local/sbin/qscan
chmod 6711 /usr/local/sbin/qscan

After testing, if everythings ok for you, remove the setuid bit :

chown 0:0 /usr/local/sbin/qscan
chmod 711 /usr/local/sbin/qscan

HAVP (HTTP Antivirus Proxy) is a proxy with a ClamAV anti-virus scanner. HTTP Anti Virus Proxy aims are continuous, non-blocking downloads and smooth scanning of dynamic and password protected HTTP traffic.
Havp antivirus proxy has a parent and transparent proxy mode. It can be used with squid or standalone.
Main features:
- HTTP Antivirus proxy
- Scans complete incomming traffic
- Nonblocking downloads
- Smooth scanning of dynamic and password protected traffic
- Can used with squid or other proxy
- Parent proxy support
- Transparent proxy support
- Logfile
- Process change to defined user and group
- Daemon
- Use Clamav (GPL antivirus)
- Operating System: Linux
- Written in C++
- Released under GPL
Enhancements:
- Experimental support was added for chunked Transfer-Encoding, which fixes some broken sites.
- The IGNOREVIRUS configuration directive was added for whitelisting virus names.
- The CLAMBLOCKBROKEN configuration directive was added.
- Detection with AVG was improved.
- HAVP is killed if database reloading fails for Library Scanner.
- The URL is logged when a crashed scanner process is detected.
- The build system updated, adding the --prefix, --sbindir, --sysconfdir, and --localstatedir options.

Open Computer Forensics Architecture (OCFA) is a modular computer forensics framework built by the Dutch National Police Agency. The main goal is to automate the digital forensic process to speed up the investigation and give tactical investigators direct access to the seized data through an easy to use search and browse interface.
The architecture forms an environment where existing forensic tools and libraries can be easily plugged into the architecture and can thus be made part of the recursive extraction of data and metadata from digital evidence.
The Open Computer Forensics Architecture aims to be highly modular, robust, fault tolerant, recursive and scalable in order to be usable in large investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.
Enhancements:
- This release fixes a memory leak in the evidence library and adds a workaround to limit the impact of a memory-hungry indexer module.

J Operating System is primarily intended for programmers.
Target Users:
- Hobbiests--You used to buy computers to do programming. They didnt do much else. Windows doesnt even come with a compiler, which is ironic since Bill Gates wrote BASIC. The "J" operating system is primarily intended for programmers. Ive attempted to lower the bar, so amateurs can contribute. I hope to recreate the dynamic environment that used to exist when the Commodore 64 was around and everyone was creating odd-ball software.
- Researchers--Im sure many lab researchers still use DOS because they have to interact with hardware, which is difficult with Windows.
Main features:
- No security! You can access all ports, memory and disk blocks to your hearts content. When youre working with your own computer, security just gets in the way and makes things slow--I hate anti-virus and anti-spyware because they just slow things down. When you know you dont have a risk, have no secrets and do regular back-ups, who needs security?
- Uniformity
- There is no virtual memory and everyone is on the same address-map. You can easily communicate between tasks, passing addresses. Addresses start at a base of zero and, essentually, segment registers are not used.
- There is basically one language to learn called "C+" which is a little more than "C", but less than "C++". You dont need to learn a scripting langauge because everything uses this syntax.
- There is an extension of ASCII called "J" rich text which allows colors, links, graphics and various widgets in your documents. This format is used in source code, documents, help, menus, etc.
- Support for compressed, encrypted and contiguous files.
- FAT32, FAT12 and ISO9660 filesystems.
- Blazing-fast compiler which can recompile everything in 5 seconds. It doesnt optimize.
- All source code is included and its still around a Meg.
Hardware:
- PS/2 mouse and keyboard
- VGA graphics
- Some hard drives. Must be on the primary or secondary IDE controller and support LBA28. Drives of 120Gig are the limit.
- Some CD-ROM/DVD drives, including burning.
- Some floppies. Just 1.44Meg and not all types.
- No USB support yet
- No network support yet
- ASCII printers on the parallel port are supported.

POP3 Virus Scanner Proxy is a full-transparent proxy daemon which scans all mails for viruses using third party scanners (built-in support for AVPD and Trophie).

You have to set up a port redirection in the linux-netfilter (iptables) so that all connections from e.g. inside your office to any POP3 server outside in the world will not leave your router, but come a local port, on which POP3VScan listens. POP3VScan receives from the linux kernel the original destinations of packets (the POP3 server outside in the world) and will connect to them.

All data we receive from the client will be sent to the server, and vice versa. With a little enhancement: we parse the neccessary parts of the POP3 protocol and when an email is sent from the server, we store it into a file, invoke a virusscanner and send it if it is good, or we just replace it with a virus notification. It should be possible to use all scanners using the scannertype=basic. Also POP3VScan provides scannertype=avpd for high-speed scanning using Kaspersky Anti-Virus for Linux, every C programmer can easily adept other scan-daemons (trophie, sophie, antivir, ...).

Neither the client nor the server has to be configured, none of them will take notice that theres a mailscanner (except the client when he gets a virus notification or if he looks into the header, and the server gets our ip as source).