Re: Re: Begs a question: AV in Linux (correction)



Although, you may want to run AV in linux for various reasons, some misleading points were made:

"If you run wine, zen, mach, vmware, or anything that runs or can run
windows (or another vulnerable OS), than you should run AV in at least
the virtual machine, and preferably in both linux and virtual machine."

Is a little misleading:
wine - Just because a windows exploit exists in windows, does not mean it exists in wine. For example - if windows has a buffer exploit somewhere in its dlls, that does not mean it will exist in wine (and vice-versa). This is because the wine team is re-implementing the windows API without looking at the windows code, and the implementations will differ.

zen, mach, vmware - just because the "can" run windows does not mean they "will" be running windows. If they aren't, don't bother.

"If you run openoffice, you are open to macro viruses and all the same
things that hit MS Office apps, and you should run an AV if you don't
want to be a hit by them, or spread them to others."

Not correct in the least - openoffice can't run word macros (although you can chose to preserve them). Even if that capability exists at some point, this statement is still flat wrong - because the open office team would be re-implementing the code, and the vulnerabilities in the windows implementation would in all probability not exist in the open office implementation (see the wine argument). Most likely they would just have different vulnerabilities ;)

"True. But you can help spread them."
Bingo!
And that's why ClamAV was made!

Stu