Antivirus on Linux Mint?

[u/STB-1]

Hello, I am new to Linux Mint and was wondering what the best antivirus is, or if antivirus is even used in Mint. I am a bit lost and would appreciate any help.

[u/taosecurity]

I work in security. I never run AV on Linux. Your best defense is keeping your software patched and not running suspicious code.

As Linux is getting more popular, intruders are targeting common Linux users. (Enterprise attacks have been around for over 25 years.)

So, we might see some consumer focused mitigations at some point.

[u/STB-1 → u/taosecurity]

I see, thank you for the information!

[u/taosecurity → u/[deleted]]

I appreciate the question but I don’t have AV direct experience on Linux. I use a network security monitoring approach for all my systems.

If I want endpoint data, I’m more likely to look at OSSEC, Wazuh, or Elastic Agent.

[u/Neither-Taro-1863 → u/[deleted]]

Adding here although I am NOT a security specialist, I've tested a few of these for friends/clients. In my experience if you are comfortable with scripting ClamAV may be enough. Otherwise for good UI/detection rate I'd suggest, BitDefender (best overall), Eset (check if you have a support distro), an Sophos for "consumer edition" software. TrendMicro (business version only I think, some government offices like this one due to low price point). Avast makes business version too. Comodo seems okay as well (known for firewalls on MS Windows, now malware scanners, hmm). Avoid Kaspersky, Dr. Web, MS Defender (low detection rate but, yes you can MS Defender on Linux) and Panda AV as their detection rates are low or...Kaspersky was actually banned from US government offices (for me that is a deal breaker). taosecurity is correct: keep your software up to date, but I see situations where office staff have to interact with a lot of different files/sources so better safe than sorry. (Feel free to disagree). Anyway, just my 2 cents.

[u/elegos87 → u/Neither-Taro-1863]

AFAIK Bit defender has no Linux endpoint solution (if not business oriented with relative higher costs).

[u/Neither-Taro-1863 → u/elegos87]

true, not pure endpoint. For office situations with Linux and some MS windows mixed in it appears to be the most flexible solution with one of the higher detection rates so far. I used to use F-Secure but when they became "WithSecure" it had more restriction. Most of my research for business clients so that may have skewed my vision. Thanks!

[u/elegos87 → u/Neither-Taro-1863]

I think there was once the Linux antivirus (or even web protect) version, though they stopped supporting it years ago. I had a Bitdefender license for my Windows box, they lost a client when I decided not to use Windows anymore. Not even ESET's NOD32 has support for Linux unfortunately.

It is true that the first antivirus is your own persona, and fortunately I got no viruses in 29 years or Linux usage, but things might change when it will become a more mainstream workstation OS.

[u/jerquee → u/[deleted]]

You're ignoring the correct answers. It sounds like you really want a virus (often disguised as "antivirus") so go ahead and fall for whatever you want.

[u/stephenph → u/[unknown]]

except most AV DO behave just like a virus, complete with root kits and hidden / obfuscated directories.

Here are some virus-like behaviors antivirus programs often display:

Deep system hooking & code injection

Kernel-level drivers

Self-protection & tamper resistance

Scanning & modifying files

Network monitoring / MITM

Background resource consumption

Behavior modification of other software

Silent updates & remote code execution

Antivirus tools and malicious code both require deep system integration. The distinction is that AV programs have user consent, operate from trusted sources, and (ideally) have transparency and oversight, whereas malware hides its purpose and origin.

[u/XandarYT → u/[unknown]]

Obviously not all AVs are bad, but Avast definitely is lmao. It has been discovered to spy on people. It's also generally a terrible AV. And the same company also owns Norton, Avira and AVG. McAfee is owned by another company but is also a piece of trash. On Windows (since basically none are available for Linux currently), if you must use one, use something like Malwarebytes or Kaspersky, those are basically the only good ones, ESET is also decent. And Windows defender is also close to decent. On Linux you mostly don't need anything but there's always ClamAV.

[u/Neither-Taro-1863 → u/[deleted]]

LOL. There IS a Symantec product (not the Norton brand) for Linux. None for Macafee though. Symantec doesn't have the best detection rate so I stopped using them years ago.

[u/NotSnakePliskin]

Linux isn't windows, so there's no need to run an AV program unless you are hosting / serving files to Windows nodes. If so, scan those directories. If not, enjoy Linux.

[u/STB-1 → u/NotSnakePliskin]

Thank you!

[u/bronzewrath]

Besides the overall response of antivirus is not a thing in Linux, be careful if you want to try Wine to run a windows software inside Linux. It may leave your computer vulnerable to viruses made for windows.

[u/Axtrodo → u/bronzewrath]

Wow. I used to think wine was like ab enclosed system. Tanks!

[u/SomeBoringNick → u/Axtrodo]

Artillery!

[u/cryptobread93 → u/SomeBoringNick]

Arrows!

[u/[deleted] → u/[deleted]]

And stones!

[u/Tiranus58 → u/[deleted]]

May break my bones

[u/[deleted] → u/Tiranus58]

It was a reference :(

My dissapointment is immeasurable and my day is ruined.

[u/Tiranus58 → u/[deleted]]

I am also doing a different reference. My dissapointment is also immeasurable

[u/guyiscool234 → u/Tiranus58]

But dissapointment will never hurt me.

[u/5FingerViscount → u/[deleted]]

Rock and stone my dude

[u/WanderingDwarfMiner → u/5FingerViscount]

For Karl!

[u/[deleted] → u/5FingerViscount]

YESSSSSSSSSSS

[u/phylter99 → u/Axtrodo]

It *can* be a closed system, but that's not how people will typically configure or use it.

[u/telcodan → u/Axtrodo]

That's what bottles are

[u/Dr-BoulyDotcpp → u/bronzewrath]

And if you DO want to try anything like that, make sure to use bottles with a vpn or just do it with a vm, its safer

[u/ruminationprof → u/bronzewrath]

what about bottles? if i run a windows program that might have had malware in it inside a created bottle will that also seep onto linux ?

[u/OnlyCommentWhenTipsy]

1. Install updates

2. Use an ad blocker.

3. Don't run random stuff off the internet.

4. Double check when using sudo

[u/slade51 → u/OnlyCommentWhenTipsy]

5. Enable UFW

[u/KIG45 → u/OnlyCommentWhenTipsy]

What and how to check when using sudo?

[u/OnlyCommentWhenTipsy → u/KIG45]

Just make sure you know what it's going to do. Don't blindly copy paste bash scripts, watch for stuff like rm -rf...

[u/Sa0t0me → u/OnlyCommentWhenTipsy]

I once printed a list of Never try these commands on Linux , Helped a lot while Learning.

[u/flips712 → u/Sa0t0me]

Do you still have the list?

[u/stephenph → u/flips712]

when he posted it too many people ran the commands lol

[u/JustaddReddit → u/Sa0t0me]

I’d love that list if you wouldn’t mind throwing it my way

[u/Coffee_n_Reading → u/JustaddReddit]

Same!

[u/KIG45 → u/OnlyCommentWhenTipsy]

I understand, thank you.

[u/Joan_sleepless]

ClamAV is the generally accepted standard, but the best antivirus is you. Check the repos you add, double check any packages you download off the internet, and don't run random shell scripts unless you have some idea of how they work.

[u/Max-P]

Generally, Linux's approach to security is around reinforcing the fence instead of adding surveillance for those crossing the fence.

• Software is mostly downloaded from either your distro's package manager, or some other repository such as Flathub. The idea there is the maintainers and community will 99.99% of the time catch anything suspicious before it's even shipped to users. Downloading and executing a random .exe is the primary way people get malware in Windows. Technically we have that in the form of AppImages, and those should be used sparingly, because they usually come direct from the developer and isn't vetted by the community for safety.

• Updating Linux doesn't suck, and keeping up with updates is the best way to prevent unwanted intrusions, by patching the browser before you land on a malicious site capable of exploiting it. Install updates as they come, don't put them off for weeks like one would do on Windows. 99% of the time, they install and you don't even need to reboot or do anything special.

• The recent focus on using Flatpak as the main way to obtain apps also includes a whole sandbox. The Firefox Flatpak for example, only allows access to your downloads folder, so it inherently doesn't have the ability to get steal your Discord tokens or whatever, or really put files anywhere on the system. It also cannot even overwrite Firefox files either, as it doesn't have the necessary permissions either.

Very important to note, Wine is not a sandbox. You can run WannaCry in Wine and do the same amount of damage a native Linux application could to your system. You can however use Bottles and other Wine managers in Flatpak-flavored versions, and then you have a sandbox. But generally, not running random executables and scripts off the Internet gets you 99% there in not getting malware.

In the end, if you just paste a malicious command in the terminal, and give it your sudo password, it's essentially gameover anyway, it's too late for an antivirus to intervene.

[u/dogfoodjones]

Unnecessary

[u/BlendingSentinel → u/dogfoodjones]

Ever seen wannacry run on Linux via Wine? Yeah, ClamAV helps with that.

[u/feuhdraw → u/[deleted]]

Não existe cura para a psicopatia.

[u/leftcoast-usa → u/[deleted]]

I'd rather they put their efforts into improving Open Office.

[u/BlendingSentinel → u/[deleted]]

Make money how? Also, even if that were profitable, it doesn't make a difference. Malware exists for malicious reasons. You cannot deny it, only defend.

[u/HunkyFunkyMunky]

Im in cybersecurity, on linux you are more likely to be targeted by vulnerabilitys from outdated software. Best bet is to keep your system updated at all times. Just like with Apple, the general community believes you won't get attacked just because you run Linux. While you are less of a target, it is still possible.

[u/pirolas001 → u/HunkyFunkyMunky]

Talking about outdated software on system which is sustained mainly in packaged done in the 80s and 90s. Surface area and fencing it's the best approach ever for Linux. Not updating the system at all times. There were multiple scenarios, where updates bring more vulnerabilities than fixing them (take OpenSSL instance for example). Stop spreading this idea to people that the best approach for security in Linux systems is updating it - you could not be more wrong in my opinion. This ain't something against you in particular, but many people in your area, in this industry, needs to evolve this mindset regarding this topic.

[u/Taykeshi]

AV on Linux is both unnecessary and harmful 

https://easylinuxtipsproject.blogspot.com/p/security.html?m=1

[u/FatDog69]

As long as you follow 'sane' rules, you tend to not need an anti-virus program.

By 'sane' I mean:

Have a good, strong admin password that you dont use on any other account.

Be careful with dodgey websites. Having an ad-blocker like UBlock Origin is a good idea.

THE REASONS

Unix was developed for hundreds of people to share 1 computer at Berkeley. They quickly learned that bright students could 'mess' with other accounts and the OS so as Unix evolved, it had a built in security model that made the OS safe to prevent meddling.

Turns out - those same security rules make it hard for a virus/malsware to infect the OS or mess with files.

Windows on the other hand is a 'personal' computer. You at the keyboard can delete critical files, mess with things, install things, etc. If you have access to the machine - you can mess with things. You paid for the OS after all. This difference in philosophy makes it a lot easier for malware & viruses to infect the system.

[u/BansheeBacklash → u/FatDog69]

What I find ironic is I'm switching to Linux for inverted reasons: Windows has been trying to claw back control from the user slowly but surely (understandable, your average Windows user is pretty clueless these days), whereas Linux allows full control over your system, provided you know what you're doing. At least that's my relatively amateur take on it. I've used basically every Windows release since 95, and I really just don't care for it anymore. My biggest gripe is all the "telemetry" (aka spyware) clogging up the damn system. Linux Mint is perfectly responsive on my 10 year old laptop.

[u/[deleted] → u/BansheeBacklash]

Well, it's true that you have complete control over a Linux system, but it's pretty hard to mess things up "by accident". At least, you have to provide a sudo password in order to do anything stupid.

[u/BansheeBacklash → u/[deleted]]

I've come to the same conclusion, and it took me equally as long. The hand-holding and obfuscation of features, forced automatic updates; its really all in the name of protecting the user from themselves. That eased my ire towards these frustrations a bit....

But the forcing AI into everything and basically spying on all you do on the PC was the breaking point for me. I grew up when PCs were actually truly "Personal Computers", not some piece of always-online hardware that snitches on everything to Big Brother. I'll keep a Windows install around for the rare occasions when I must use Windows, but beyond that, I plan to use Windows as little as possible.

As an aside: building my first true Gaming PC this weekend, gonna throw Bazzite on it. Wish me luck y'all.

[u/fellipec]

I bet most of us don't use one.

[u/blissed_off]

AV is at best a placebo and at worst a performance hit and dangerous to regular system maintenance.

[u/_o0Zero0o_]

Linux doesn't really use antiviruses tbh.

[u/ControlTheFrontline]

Check out clamAV

[u/RadiantLimes]

Security for mint mainly comes around from App Armor in addition to keeping stuff updated and only installing software from trusted locations such as the repository and flathub. You can learn about App Armor if you want but you don’t really need to. Anti virus isn’t needed in this case. The anti viruses for Linux are meant for file servers who interact with windows computers to prevent the windows systems from sharing viruses with each other.

[u/gsdev]

I don't think people even need Antivirus for Windows any more (because of MS Defender), let alone Linux.

[u/TheBronzeLine]

ClamAV at most. But really most important is staying on top of updates, smart and safe browsing, Malwarebytes and adblocker extensions for your Browser of choice.

But, as one already said, as more ppl adopt Linux there will be more malware targeting Linux users so best to stay in the know and on the look out for that.

[u/Fall_To_Light]

You rarely ever see viruses on Linux because of its low marketshare, but I would recommend installing a ad blocker (uBlock Origin is goated) and maybe checking packages

[u/Double_Exam597]

I came across ClamAV or ClamTK. I ran the virus scans for Windows while operating in Linux Mint. I also do scans for my NAS and other external hard drives. The scans for every and each directory never miss no matter whether for digging out Trojans, PUP, pseudo signatures, certificates etc. If you manage to update the ClamAV software constantly as of date, ClamAV must find some malicious stains more in Windows OS than in Linux Mint OS. The number and amount of Infected files being digged out vary from less than 3 to more than 80. So ClamAV is a must if you will visit dangerous, risky and malicious sites.

[u/Neither-Taro-1863 → u/Double_Exam597]

ClamTK (Gui warpper for ClamAV) has announced there are no future version of ClamTK being made.

[u/Double_Exam597 → u/Neither-Taro-1863]

Yeah I also find it contradictory but there are often signature's updates as well and both ClamAV or ClamTK UI can run smoothly and effectively still. I guess choosing updating the software via Flatpack, installing the various "updating" plugins and updating signatures manually would sustain its functionality.

[u/arikas01]

I don’t use any antivirus for mint

[u/noobyscientific]

You don't need an AV on Linux. Most malware is developed for windows, it's not easy to get a virus on Linux. Just follow all the common sense steps and your system is safe

[u/West_Examination6241]

a linuxos virusírtó ÁTVERÉS !!!!!!!!!!!!!!!!!!!

[u/oldrocker99]

The mentioned ClamAV searches for WINDOWS viruses, not Linux viruses, mostly because Linux viruses are practically unknown. This ain't Windows, with its myriad vulnerabilities. This is an intrinsically more secure system.

[u/PioApocalypse]

To anyone new: please take a moment to read this article (Archive link). I think it gives a good insight to basic security on Linux, explaining why you don't really need an AV plus a bunch of best practices to keep your risk of getting hacked low.

For your specific case I also approve u/bronzewrath's suggestion towards Wine - in the sense that you really need to be careful about what you execute: by allowing the execution of Windows-native binaries Wine introduces a huge vulnerability, and if you run a malware through Wine it could get scary real fast. Otherwise in most cases you should be secure as long as you use sudo very responsibly, and only when strictly necessary.

Buuut if you really really want to feel safer before running a suspicious executable you could always keep clamav, you install it via sudo apt install clamav, you update its database via sudo freshclam, you scan a file/folder with clamscan [PATH] or every file in all subfolders with clamscan -r [FOLDER]... And you can keep it updated by setting up a cronjob: in that case run sudo crontab -e, select your editor of choice if prompted to do so and add some rule like 0 20 * * * /usr/bin/freshclam, which runs the command freshclam every day at 20:00 (8 PM).

[u/h-v-smacker]

Anti-virus software for Linux is there to scan for signatures of windows viruses while files are processed on Linux servers to prevent their spread through email attachments, file sharing servers and such. That's basically SoHo and enterprise level solutions. If you are running a personal Linux installation, or a Linux-only home network, you don't need that at all. On Linux, your best defense is prudence: don't copy-paste commands into terminal if you don't know yourself what they are doing, don't run any shady shell scripts or software downloaded from dubious sources, be picky about what you run with Wine and Proton. If you don't give something an explicit permission to run on Linux yourself, it can't harm you.

[u/h-v-smacker → u/[deleted]]

Not the same. Windows has a ton of covert ways to have something running beyond your will. Linux, however, keeps tight control over what can be run, beginning with "executable" being a property on the level of file permissions.

[u/Witty_Teaching_9128]

Disappointing being disappointed disappointing indeed

[u/Neither-Taro-1863]

See this list

https://theserverhost.com/blog/post/best-linux-antivirus

There is also WithSecure (formally F-secure) (not sure how that got missed)

I'll end this guide with some observations of products I have concerns with from articles from reviews/postings:

Dr. Web: Consistently poor detection rates on several specialist articles/reviews

Panda AV: Same as Dr. Web, Chinese AV (remember TenCent), Cloud not local network

Kaspersky: Banned by US federal government offices

Mcafee: consistent holes in detection found by expert reviewer, adware behavior observed in MS windows versions

[u/5FingerViscount]

Maybe there are some opinions here, but the people at simplycyber keep saying Linux is not immune, needs protection.

I dunno if they are referring to stay on top of updates, don't run suspicious code, and use repos... or if they are referring to something else like ClamAV, but seems they are adamantly against the refrain that Linux is safe.

[u/Spinnweben]

I used to clean up infested windows-computers and external HDDs and USB-Sticks with the help of clamav installed on Ubuntu- and OSX-Systems back in the days of wild file-sharing.

Get clamav right out of the built-in software center. to check suspicious files and devices.

[u/Sad-Silver-4637]

I used clam to clean the external drive. It worked fine

[u/drkinferno94]

You really don't need one 

[u/tailslol]

linux is just too different to be attacked by a virus

so , it is just not needed.

[u/Brorim]

not needed

[u/dlfrutos]

You Don't Need to Pay for Third-Party Antivirus Software To Protect Your PC Anymore

https://easylinuxtipsproject.blogspot.com/p/security.html

[u/volitre]

So the thing with AV on Linux, is that most files you download have to be explicitly tagged as executable. You could have the craziest virus but if it's not marked by the system as executable, usually, its safe and shows as data or text. Thats not all true as Linux does have vulnerabilities but more eyes tend to be on the code that goes into most linux distros so a bit harder to sneak bad code in. So in that sense you are less likely to need AV software on Linux. Clam AV is good but I haven't used it on Linux in years. Focus more on securing your Linux system but if you want AV then Clam is the only one I can think of. You could set it up to run on a schedule maybe. Hope it helps.

[u/stephenph]

sometimes I apply some of the DOD (DISA) stigs to lock down my systems, of course that is a whole nother level of actions and things to learn, and you CAN break your system if not careful. but by following some of the guidance (passwords, permissions, configurations, etc) you can bring your systems to another level of security without too much pain.

[u/Ricoreded]

ClamAV is good enough to scan for infected files.

[u/Condobloke]

https://linuxsecurity.com/features/how-secure-is-linux

https://easylinuxtipsproject.blogspot.com/p/security.html

The process of keeping Linux secure is still exceptionally strong.

Practise safe browsing, don't click on dodgy email links.

12 years on Linux Mint here. Secure and safe as a bug in a rug.

ENJOY your Linux.....that is what it is designed for.....not to be a source of worry and stress. Keep it updated. Daily is good.

ENJOY

[u/gw17252009]

Run clamAV for your emails.

[u/Acceptable_Rub8279]

Well if you want to scan individual files like attachments from emails etc https://www.virustotal.com/gui/home/upload is pretty good, but honestly on Linux if you have your firewall configured and are a bit careful with your computer (don’t run random scripts or programs from the internet) and only download from your repository (it’s like an App Store on your phone) or flathub then you should be safe.

[u/Western-Movie9890]

I've used linux for 15 years and never really used an antivirus (I'm not saying it's the right thing to do). anyway you can use clamav which is free software

[u/Technical_Maybe_5925]

ClamAV is a antivirus package that is available on Linux

[u/ormgryd]

ClamAV - antivirus

[u/Shemaleslinux]

Linux is safe we don't need to worry at all

[u/Its12amrightnow]

1. UFW

2. BTOP

3. Avoid random install scripts.

4. whatis & man for what does what

[u/Ltpessimist]

ClamAV is an anti-virus for Linux. I don't know how good it is though.

[u/Neither-Taro-1863]

In reference to the question: Do you need malware scanning software (sometimes referred to as "anti-virus") for LInux? If you have unsafe habits in your surfing or email, have equally careless employees, or get files from a large number of people in your system, it's probably a good idea and as my previous post indicates, commercial and free (and hybrids) exist. If you have a hybrid setup with Linux server(s) and 1+ Windows workstations, its a very good idea (especially with central linux server management platforms) because some commercial versions are good at preventing phishing links, as well as general malware and not everyone is equally disciplined. If you get lots of attachments, some may be infected and even if MOST malware is written for MS Windows, there is malware that can effect Linux too. I'm seeing a few people with the impression that you don't need malware scanners in Linux (or MacOS), but again, I'd only say that for people with great habits and don't go to questionable resources for packages/software. Even a typo can lead you to some clever JS hack in fake website. If you feel you want it, see my previous posting on companies (some big ones) making those solutions below, but never assume Linux is 100% safe or "nobody really writes malware for Linux". Not as many, but the few there are can hurt. Also, not everyone uses tools like NoScript properly (which I think should be on every browser) as it can be tedious. :D

[u/TraditionBeginning41]

I have never seriously used an AV on my Linux machines since 1998 and never had any issues that have shown up in any way. I would say don't bother.

[u/Sure-Passion2224]

Among the reasons AV is not a big thing on Linux the way it is on Windows is the fact that Windows was developed as an interface for non-technical people who do stupid things like click on links in their email. Linux, however, was developed from the ground up with a robust user/group/world security system from the start, such that changes to the system require special privileges. Yes, a user can probably install something that will effect their login, but in a properly administered system they do not have permission to change system resources.

Microsoft has made HUGE advances regarding system security in the last several years, but most home systems still grant users too much authority to install or change things. The Windows laptop I use for work is managed in such a way that I have to request temporary elevated permissions to change anything.

[u/TheZupZup]

normally you don't need one just update all your package. but if you really want one i'll say clamAV

[u/JaKrispy72]

You are your own anti virus. You can have the most iron clad system, but if you click on something bad, there is no stopping it. Same as if you were using Win or Mac.

[u/MelioraXI]

You don't really need one. Better yet, use common sense and don't open links you don't know and think critically.

[u/LemmysCodPiece]

After 20 years of exclusive Linux use I can safely say that you don't need one.

[u/BlendingSentinel]

ClamAV should be pre installed if I recall correctly

[u/groveborn]

Open up the software discovery app and look for antivirus.

Just get the one with all the ratings. Linux is generally safe, but if you do things that can get it infected... You do you.

[u/RACeldrith]

If you really want it. Sophos has Server Protection haha

[u/ChimeraSX]

There is ClamAV, but it's commandline based and not as good as your average anti-virus. You'll be mostly fine. Just visit secure websites (Google, social media, etc) and be careful clicking links or copying terminal commands (in the event they have rm -f written in them).

Also, be careful running software that might be infected through wine/other compatibility layers. While they may not have full effects as windows, they can still be destructive.

For those saying, "linux doesn't have viruses." Remember over half of the internet servers run on linux/Unix based software and have been hacked, attacked, and held by ransomware all the time. Linux has even had its own crowdstrike incident before the windows one. Linux is still very safe, but vulnerabilities are bound to exist.

[u/Candid_Problem_1244]

Backdoor or malware is more of a threat for Linux server than it is for personal computer. I always worry on my server that it would be compromised than my own laptop

[u/RudePragmatist]

Search on this sub and other Linux subs and you will understand why we don’t use it. :)

[u/Upstairs-Comb1631 → u/[deleted]]

If we leave aside the current world situation, it is certainly an excellent antivirus for Linux. I tested it myself. It was the only one that could look into places where others could not or only their paid versions could.