Free virus scans software for linux

AntiVirus Scanner is an anti-virus scanner for Endeavour Mark II that uses the ClamAV library (libclamav).

AntiVirus Scanner allows you to create a list of scan items for frequently scanned locations and features easy virus database updating, all in a simple GUI environment.

Kvirus project is a board/puzzle game for the KDE Environment.

Kvirus is a board game for the KDE Environment and a clone of Ataxxlet originally written in Java.

The goal is to copy or jump your virus to eat up the enemy virus. Kvirus provides a cute interface with hours of fun.

Simscan is a simple program that enables qmail-smtpd to reject viruses, spam, and block attachments during the SMTP conversation so the email never makes it into your computers. Very efficient and written in C. It is made from open source components and is completely free
Main features:
- Runs as a separate program under a separate user than any other qmail program to limit possible security problems.
- clamav virus scanning ( --enable-clamav (default yes ) ). Rejects email containing viruses.
- trophie/TrendMicro virus scanning.
- support for spamassassin 3.0 and 2.6 series.
- spamassassin scanning ( --enable-spam (default no ) ). Rejects email that has X-Spam-Flag: YES set.
- spamassassin hit level rejection ( --enable-spam-hits (default 10.0 ) ). Requires --enable-spam to be enabled. Allows for rejection of email above a certain hit count. All other email is passed through with spamassassin headers and changes.
- attachment blocking ( --enable-attach (default no ) ). Blocks emails with attachments listed in a control file.
- fine grained control of clamav/trophie/spamassassin/attachment blocking per user/per domain/per system. ( --enable-per-domain (default no))
- logging of virus name, IP and to/from addresses to smtpd log file when a virus is detected.
- configuration option to set custom spamc arugments --enable-spamc-args
- configuration option to add -u user@domain argument to spamc --enable-spamc-user
- received header which includes virus scanner and spamassassin version nformation
- works with open source Clam AntiVirus by the Clam Team.
- works with open source trophie virus scanner interface to TrendMicro.
- works with open source SpamAssassin by the Apache Group.
- works with open source QMAILQUEUE patch by Bruce Guenter.
- works with open source ripmime by Paul Daniels.
- works with freely distributable Qmail by D. J. Bernstien.
Enhancements:
- virus drop message was not exiting at the right time. Found by Russ Lists
- use per domain hit count on spam log message if set.
- if read from standard in fails the temp file was not closed so the temporary work directory would not be removed.

gadoyanvirus is a virus checker for qmail that works with the QMAILQUEUE patch by Bruce Guenter. gadoyanvirus scans incoming messages using the ClamAV anti-virus library.

Suspected messages are quarantined and a notification message can optionally be sent to the recipients.

Viralator is a Perl script that virus scans HTTP/FTP downloads request on a UNIX server after passing through the Squid proxy server.
Even when I implemented virus protection for my network email server we still continued to get the odd virus. Most of the viruses came from people using free webmail accounts like Hotmail or Yahoo and downloading the infected attachments to their machines or through downloading junk.
Rather than block access to the users I decided to look at how we could better protect the network. I looked at a couple of different products both comercial and free but they were either too expensive or did not meet my needs.
That is how Viralator was born. Viralator Proxy Virus Scanner is licenced under the GPL.
Viralator should work in any UNIX system that uses Apache and Squid servers. We have reports about successful instalations on:
- RedHat Linux
- Mandrake Linux
- SuSe Linux
- e-Smith Linux
- Slackware Linux
- Conectiva Linux
- Debian Gnu Linux
Supported Redirectors:
- Squirm
- SquidGuard
- Jesred
Supported Virus Scanners
- AntiVir
- AVP
- RAV
- Inoculate
- Sophos Sweep
- McAfee
- Trend
- Clamav
- Bit Defender (free edition)
The original concept for Viralator came from the Viromat project. Without Viromat the Viralator project would not have had a starting point. We can also thank Ralph Meyer for badgering me into releasing the script under the GPL.
Enhancements:
- Parenthesis are included on the regular expression used to validate URLs.
- The character set checking step, which was not working before last patch released, has been fixed.

Virge is mail scanner written in C, which replaces/substitutes procmail for a while, checks the incoming mail, and then sends the mail to the procmail. It will check mail for viruses and/or attachment names. Check the FEATURES/README/NEWS files for more details. Virge requires Sendmail and (optionally) AVPDaemon, Sophie or Trophie (to check attachments for viruses).
Virge replaces temporarily procmail. When new mail comes in, Sendmail will pass the contents of the mail to Virge. At that point, Virge performs set of checks:
Checks if the mail has attachments. If it does not, it sends it to procmail for delivery.
If mail has attachments, Virge creates temporary directory, unpacks attachments there, and asks AVP/Sophie/Trophie to scan the temporary directory for viruses. Virge was created with 2 things in mind: performance and security. Because of performance issues, it was not feasible to use any command line scanners like TrendMicro of McAfee ones.
AVP/Sophie/Trophie are instructed to scan attachments for viruses next. If it finds any viruses, mail is immediately isolated in a directory not (hopefully) accessible to anyone except administrators.
If no viruses were found, Virge will then perform attachment check, and see if any of the attachments are not allowed to be sent to the end user. A configuration file is consulted for list of extensions (or full filenames) that should not be allowed in. If any such attachments were found, tricky part comes - Virge will *hopefully* properly "rewrite" the whole email, and strip the attachments that are not allowed. Small notice is attached at the end of the mail, with names of stripped attachments. Mail is also isolated, in case poor overworked sysadmin ever gets some free time to take a closer look.
IMPORTANT: Please, keep in mind that Virge will *NOT* rewrite & send mails when virus has been found. I will *NOT* implement any such features, since it doesnt make any sense (I havent seen a mail with virus that actually had some valuable content in it for many months - maybe even years).
If AVP/Sophie/Trophie are not available (daemon is down), Virge will still deliver mails and annoy admins through syslog messages. Attachment check is still performed.
Users for which no checks should be performed can also be configured. Location of the file can be specified in the configuration file.
Virge is definitelly trying to not let any lame script kiddies abuse it in any way. It is trying to resist to race conditions, buffer overflows, and similar neat tricks. No guarantees, of course, that there are no security problems in Virge.
Virge tries to be as fast as possible, and not waste CPU time or any other resources. It is still possible to make it perform even better, although I presume it would be in 1-5% range. Will take some more time later, and try to fix all the small performance problems.
And yes - Virge *is* fast. I have made a complete Virge V1 in Perl some time ago, but it was absolute failure. Although I tried to use as little modules as possible and make it as fast as possible... it was crap. 2 minutes after I started a script that sends 3-5 mails per second, I started wondering "Why the hell cant I login to the mailserver anymore?". Perl is nice, but its not good for tools like this. Not at all (except if you have low traffic on your mailserver).
And Virge still needs a *lot* of testing. I have tried to test Virge with many different mail (MIME) formats and tried different tricks in order to bypass its decoding techniques (in order to send a virus or .exe to users), but it handles things pretty well. There are cases, though, when it is possible to trick librfc2045 and send attachments that dont get caught, but those attachments are violating RFCs anyway. If your mail client is so stupid to decode invalid/malformed attachments/mails - you deserved it. Dont use stupid mail clients then. Im not going to start adding all those crappy features into Virge that would let someone detect all possible tricks which can be used. Use good mail clients, dont rely on Virge to save you.
Main features:
- Virge can check every incoming mail for attachments, and can remove attachments that are considered dangerous.
- "Dangerous" can be defined:
- email with specific kinds of attachments (e.g., .EXE, .COM, etc.)
- email that contains a virus as identified by Sophie ( http://www.vanja.com )
- email that contains a virus as identified by trophie ( http://www.vanja.com )
- email that contains a virus as identified by AVPDaemon (http://www.avp.ch)
- Any combination of the above.
- Dangerous email can trigger:
- rewriting that removes virus.
- alert back to sender.
- alert to recepient.
- alert to system manager.
- rewrite to remove virus.
- All offending mail messages can be isolated for later reviewing.
- Written in C, so it is very fast, doesnt waste resources, and doesnt depend on a complicated perl installation (which is subject to breaking).
- Notification can be sent (configurable) to sender/recipient of suspicious/infected mail. Templates can be used to define the layout of the mail.
- Regular expressions can be used for filename matching
- Virge was made with security in mind, and should be hard to abuse
- Can be configured to fail open or fail closed if load on the machine goes too high.
- Virge 3.0 designed for easy integration with Postfix

mdns-scan is a tool for scanning for mDNS/DNS-SD published services on the local network. mdns-scan issues a mDNS PTR query to the special RR _services._dns-sd._udp.local for retrieving a list of all currently registered services on the local link.
mdns-scan is not a good mDNS citizen since it queries continuously for services and doesnt implement features like Duplicate Suppression. It is intended for usage as a debugging tool only.
mdns-scan is incomplete since it doesnt resolve mDNS services for you - it just dumps their PTR RRs. To understand these records you need minimal knowledge of DNS-SD and how it works.
mdns-scan does not terminate on its own behalf. It scans for services continuously until the user kills it by pressing C-c.
mdns-scan does not rely on a local mDNS responder daemon. It has no dependencies besides the GNU libc. It has been tested on Linux only.
mdns-scan does NOT scan for local mDNS enabled hosts or A/AAAA RRs, it scans for DNS-SD registered services, nothing else.
Enhancements:
- Add man pages
- Improvements to the Debianization