Free malware software for linux

LaBrea is a intrusion detection / "sticky" honey pot technology using virtual servers to detect malware. LaBrea takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet. The program answers to connection attempts in a way that the machine at the other end gets "stuck", sometimes for a very long time.
LaBrea works by watching ARP requests and replies. When the pgm sees consecutive ARP requests spaced several seconds apart, without any intervening ARP reply, it assumes that the IP in question is unoccupied. It then "creates" an ARP reply with a bogus MAC address, and fires it back to the requester.
An example (from a tcpdump of LaBrea running on my network):
14:18:28.832187 ARP who-has xx.xx.xx.13 tell xx.xx.xx.1
14:18:29.646402 ARP who-has xx.xx.xx.13 tell xx.xx.xx.1
14:18:31.707295 ARP who-has xx.xx.xx.13 tell xx.xx.xx.1
14:18:31.707574 ARP reply xx.xx.xx.13 is-at 0:0:f:ff:ff:ff
There is no xx.xx.xx.13 machine on my network. In this case, the timeout was set to 3 seconds (its a command line parameter), and when that final "who-has" came in, the "is-at" reply that you see was generated by LaBrea.
There isnt a MAC address of 0:0:f:ff:ff:ff either. It doesnt exist.
But now, the router (xx.xx.xx.1) believes that there some machine at xx.xx.xx.13, and that it resides on the MAC address 0:0:f:ff:ff:ff, and so it dutifully sends packets on. In
essence, weve created a "virtual machine" on that IP address.
Now, LaBrea also watches for TCP traffic destined for the ether address 0:0:f:ff:ff:ff. When it sees an inbound TCP SYN packet, it replies with a SYN/ACK that "tarpits" that connection attempt. Everything else is ignored. (Well... sort of. LaBrea also tries to give its "virtual machines" some character... you can ping them, and they respond to a SYN/ACK with a RST.
Theres more to it than that (obviously...) but youll need to read further.
Enhancements:
- src/ctl.c (ctl_init_arrays): Remove call to sleep since not supposed to mix with alarm calls on linux.
- src/utils.c (util_alarm), src/labrea.c: Set alarm and signal handlers after going into daemon mode so that child will get signal
- src/labrea_init.c, src/lbio.c: Take out fudge code since libdnet 1.7 ethopen now uses the libdnet device names (ie eth1, etc).

mwcollect is an easy solution to collect worms and other autonomous spreading malware in a non-native environment like FreeBSD or Linux.
The first versions were used to collect binaries for botnet monitoring and bots are still what mwcollect is mostly used for collecting.
Some people consider it a next generation honeypot, however that comparison often leads to the misunderstanding that computers running mwcollect can actually be infected with the malware - that is not the case!
Enhancements:
- This release adds a submit-gotek submission module, fixes some bugs in the timeout code, and builds cleanly under FreeBSD.

Whitetrash is a user-friendly and sysadmin-friendly proxy that makes it significantly harder for malware to use HTTP and SSL for:
- initial compromise;
- data exfiltration; and
- command and control.
Main features:
- Provides whitelisting for HTTP and SSL that is good for both users and sysadmins, but defends against malware and browser exploits.
- A HTML rendered whitelist report that can be viewed by all users. Can also be used to generate static whitelists for popular domains.
- Fast: no noticeable impact on users browsing urls already in the whitelist, and adding a new URL is very quick.
- Secure: As this is a security product, great care has been taken to sanitise input, flow control etc. so that the whitelist cannot be easily circumvented or exploited.
- Users can delete their own whitelist entries (optional). Admins can delete any whitelist entry.
- A HTML report that lists all domains requested but not whitelisted - good for tracking down malware/adware and generating static blacklists.
- Configurable authentication: any sort of authentication can be used. Squid provides plugins for NTLM, basic, and digest but has an extensible interface for other authentication schemes.
Enhancements:
- This release adds a number of new features.
- Users can now delete their own whitelist entries and admins can delete any whitelist entry.
- A new HTML report is available that lists all domains requested but not whitelisted; this is good for tracking down malware/adware and generating static blacklists.
- More statistics on domains are available, including hit counts and last visited time stamps.
- Any authentication mechanism supported by Squid can now be used.
- Squid provides plugins for NTLM, basic, and digest, but has an extensible interface for other authentication schemes.

People Search and Public Record Toolbar is a Firefox extension is a handy menu tool for investigators, reporters, legal professionals, real estate agents, online researchers and anyone interested in doing their own basic people searches and public record lookups as well as background research.
Find past friends, relatives, classmates, coworkers, military buddies or do background research on people and businesses.
This useful extension offers you the following free people and public record searches at the click of a mouse:
- Free People Searches: White Pages, 411, DA Plus, Zaba Search, Zoom Info, Google, International Phone Directories, Google Image Search and Riya photo search.
- Reverse Phone Numbers: White Pages, DA Plus, Google, Land Line or Cell Phone? Search, Reverse Payphone and Do Not Call List.
- Reverse Addresses: White Pages, DA Plus, Google, Mail Drop Search and Whois Lookup.
- Area Code, Zip Code and International Calling Code Searches.
- Yellow Pages & Local Searches: White Pages Yellow, DA Plus Yellow, Google Local and Yahoo Local.
- Public Record Searches: Skipease Public Record Directory, Search Systems Public Record Directory, Social Security Number Searches, NETRonline Property Records, Zillow Property Values, Trulia Real Estate Search, Yahoo Real Estate and NACO US County Information.
- Criminal Searches: Inmate Locators and National Sex Offender Registry.
- Maps & Satellites: Google Maps, Map Quest, Yahoo Maps, Google Earth, Terra Server.
- Government Phone Directories: US Blue Pages, Canada GEDS.
- US Government Search Engines: FirstGov and Google Government Search.
- News & Blog Searches: Google News, Yahoo News, Technorati, IceRocket and Google Blog Search.
- Business & Finance: Alibaba, Business.com, Thomas Registry, Google Finance, Yahoo Finance.
- Jobs & Classifieds: Indeed Meta Job Search, Simply Hired Meta Job Search, Dice Jobs, Hot Jobs, Monster Jobs, Craigslist Classifieds.
- Social Network Sites: Facebook, Friendster, MySpace, Tribe, Xanga.
This extension contains NO malicious scripts or code; no malware, spyware or adware of any kind. This extension does NOT record personal or surfing information from users. If you dont believe me, then check the source code on the extension after you download it. There is absolutely no Spyware or malware of any kind and the same person continues to attack this extension and defame it using numerous different logon ids.

QArchive.org web files checker is an extension which allows people to check web files for any malware.

The add-on allowing people to check web files for any malware (viruses, trojans, worms, adware, spyware and other unwanted things) inclusions. Install this plug-in to your browser, reload it. Then click the web file link by right mouse button and choose a "Check files with QArchive.org".

Then follow web site instructions. The usual way: your file will be enqueued. Refresh the report page to get completete antivirus report. That will show you all web files part checking and a summary as well. If you are a web master you can you the useful feature.

Taking the code of received report and placed it on your web site you can inform people about a concrete file safety. The web forums code version exists as well.

PPSee is a software for creating picture galleries of photos taken by the digital camera, scanner etc. It also makes possible to view pictures.
The created photo album can be used on your computer, however it is designed mainly for display on the Internet. Instead of photos attached to e-mails, youd better send a link to your own web pages!
Main features:
- the program uses national languages.
- the photo album provides automatic picture projection - slide show
- to move among the pictures in the photo album you can use navigation keys.
- each of the pictures can contain your description, which is saved for later use.
- you can rotate images without any modification of the original file
- photo album is based on a valid code XHTML 1.0 Strict
- the photo album does not need support from any server.
- the program has many attributes affecting the look of the created photo album.
- support of the scripting language BeanShell for greater latitude when creating the photo album.
- you can create their own templates of the photo album.
- registered users can use a batch mode from a command line
- the program can read EXIF information.
- the program runs on the systems such as Windows, Linux, MacOS, OS/2 and Solaris, as well as the photo album.
- registered users can also use new versions of the program.
- the author does not insert into program any form of malware, including: spyware, trojans and backdoors
The program PPSee enables to change the photo album by the help of a number of parameters, however a certain style of the photo album always remains preserved. If you have your own conceptions of the look of the photo album, lay-out of the pictures, navigational buttons, picture description and so on, you can create a template.
The template of the program PPSee is a model, based on which the program creates the real photo album. It is useful to know that templates - or more exactly their program accessories - enable to respect the parameters set in the user graphic environment of the program PPSee. To communicate with the program, templates use the program interface API.
Templates can be saved - together with other parameters - for later use; users can share the saved templates with no limits. Only registered users can work with templates. Detailed information makes part of the program documentation.
Enhancements:
- Photo album is created by a standard XHTML 1.0 Strict.
- You can rotate images without any modification of the original file.
- Bug fixing

Antispyd is a HTTP/HTTPS proxy server designed to be fast, efficient, modular and secure. Its written in pure C and uses a simple and customizable configuration file. Its POSIX compliant and has been developed under Gentoo/Linux.
The server is designed with a modular software architecture, the following filters can be used and configured independently :
Url Filtering
Mime-type Filtering
Web-Identity Masking
Shellcode and Zero-day threat Filtering
Cookie Removal
Simple Signature based Filtering
Inappropriate content Blocking
Pop-up Deleting
So, Antispyd can be used to satisfy some current companys security needs like :
Web Usage Policy establishment
Instant Messaging control
Peer-to-Peer Filtering
Malware Protection
Enhancements:
- This release provides a major improvement of the signature based filtering engine (the BLOCK_SIGN filter) in terms of both performance and functionality.
- The signatures are now stored in a 3-Tree to enhance the matching of each HTTP message.
- This filtering can be performed on each HTTP messages content.
- A signature can use the hexadecimal array of a byte to specify a fields value