On Tuesday 02 September 2003 11:55 pm, Kelly Fulks wrote:

On Tuesday 02 September 2003 15:52, Praise wrote:

...

Alle 22:33, martedì 2 settembre 2003, Marco Oliveira ha scritto:

[stuff deleted]

...

...

5 - What kind of protection could i use (Anti-Virus software) ?

Antivirus for Linux detect only windows viruses.

Not totally true. I know that F-Prot will detect Windows virii on a Linux machine, but it will also look for Unix/Linux worms and trojans within the system. You can download it for free (personal use with Linux) and it is inexpensive on Windows and seems to work. I haven't tried the server side stuff for Linux or Windows.

Out of interest Does it list which Unix/Linux infections it checks for? If so how many?

-- Kelly L. Fulks Home Account near Huntsville, AL

Hi there, "...This is true to a point, but be aware that Windows Virus can cause problems

when using programs such as samba, wine or other software that provide services for Windows. ..."

Can you explain that, please ? Thanks On Tuesday 02 September 2003 22:07, Graham Smith wrote:

On Wed, 3 Sep 2003 06:54, Dylan wrote:

...

On Tuesday 02 September 2003 21:33, Marco Oliveira wrote:

...

Hi there, i have some questions about virus and linux, can you help me ?

1 - I would like to know if linux is affected by windows virus and worms ?

Not directly, no. The virus program won't run on Linux, so you might receive one but it won't be able to infect the machine or deliver any other payload.

This is true to a point, but be aware that Windows Virus can cause problems when using programs such as samba, wine or other software that provide services for Windows.

-- Regards,

Graham Smith ---------------------------------------------------------

I'm a samba user, so, all the files that i have in samba mounts can be infected, but not the linux itself (i was thinking in a virus that infects files) ? "...Another example would be if you are using MS Word under wine or Win4lin on

your Linux box and open a word file which has a macro virus you would be in trouble. That said if you open the same file using openoffice it wouldn't be a problem as the macro cannot run. ..."

In this case, what could i do to terminate the virus ? Marco On Tuesday 02 September 2003 22:40, Graham Smith wrote:

On Wed, 3 Sep 2003 07:26, Marco Oliveira wrote:

...

Hi there,

"...This is true to a point, but be aware that Windows Virus can cause problems

...

when using programs such as samba, wine or other software that provide services for Windows. ..."

Can you explain that, please ?

Thanks

If you are using Outlook via Wine for instance you would be possibly at high risk. This would only effect files and directories assessible to you on the linux machine.

Another example would be if you are using MS Word under wine or Win4lin on your Linux box and open a word file which has a macro virus you would be in trouble. That said if you open the same file using openoffice it wouldn't be a problem as the macro cannot run.

Also Samba mounts can be infected by Window machines accessing files on the server just as they would be effected on a Windows server.

I hope that explains my statement better.

-- Regards,

Graham Smith ---------------------------------------------------------

Graham Smith wrote:On Wed, 3 Sep 2003 07:55, Marco Oliveira wrote:

I'm a samba user, so, all the files that i have in samba mounts can be infected, but not the linux itself (i was thinking in a virus that infects files) ?

"...Another example would be if you are using MS Word under wine or Win4lin on

...

your Linux box and open a word file which has a macro virus you would be in trouble. That said if you open the same file using openoffice it wouldn't be a problem as the macro cannot run. ..."

In this case, what could i do to terminate the virus ?

Marco

With samba mounts you can use a Windows Box with a virus scanner to remove any infected files if you are lucky. Otherwise you will need to revert to your backups. You do backups I hope! If using vmware or Win4Lin you should be able to run a virus scanner. On Wine or Codeweavers Crossover I don't know of any virus sanners that work. Files infected by a virus using Wine would have to be removed by hand. The linux operating system itself would not likely to be effected. -- Regards, Graham Smith --------------------------------------------------------- -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com --------------------------------- Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software

On Wednesday 03 September 2003 07:18, zentara wrote:

On Tue, 2 Sep 2003 22:26:16 +0100

The biggest danger is if you have a dual boot with windows and linux. If you boot into windows, and it finds and runs a virus, it can damage anything on your disk. If the linux kernel isn't running, your linux system isn't protected.

Whoa !! Are you saying that in a dual boot system a windows virus can infect the Linux partitions? Windows doesn't even know that Linux is there and they are different filesytems, FAT32 vs ext3. Mine are even on different hard drives. Please tell us a little more. My Win 98 system is a mess, no virus protection, nothing, and don't really care. Only keep it to run a few games and some Flight Planning software. Bob S.

On Wed, 3 Sep 2003 22:38:56 -0400 "Bob S." wrote:

On Wednesday 03 September 2003 07:18, zentara wrote:

...

On Tue, 2 Sep 2003 22:26:16 +0100

...

The biggest danger is if you have a dual boot with windows and linux. If you boot into windows, and it finds and runs a virus, it can damage anything on your disk. If the linux kernel isn't running, your linux system isn't protected.

Whoa !! Are you saying that in a dual boot system a windows virus can infect the Linux partitions? Windows doesn't even know that Linux is there and they are different filesytems, FAT32 vs ext3. Mine are even on different hard drives.

Please tell us a little more. My Win 98 system is a mess, no virus protection, nothing, and don't really care. Only keep it to run a few games and some Flight Planning software.

I'm sorry to dissapoint you, but you can have some real damage done by the windows kernel running. It may not know how to read ext3 but it knows something is there. Just do an fdisk in windows.....do the linux partitions show up as "unknown" or "not there". Sadly a virus can be written to do anything anywhere on the disk, only if the linux kernel is running, will it observer "permissions" and the programs right to write to some area of the disk. Windows observes no permissions. So a windows virus can say write a bunch of 1's at some place where the ext3 filesystem is. Then you get file corruption, and if it targets the boot area, you may not be able to boot. Also, you know not to run "defrag" in windows, when you have a dual boot with linux. Many a linux system has been messed up by defrag. It's also becoming possible, for very clever trojans to be introduced into linux, from running windows. Say for instance, a clever windows hacker wrote a virus which scanned linux partitions for libc.so.6 and modified it somehow. Then everytime you ran a program back in linux, you could be spreading something injected by windows. The lesson? Do not have dual boots with windows, if you need security. Dual boots are risky business. -- I'm not really a human, but I play one on earth.

*** Reply to message from Jerry Feldman on Thu, 4 Sep 2003 09:24:39 -0400***

While I man not fully agree with Zentara on dual boots, he is dead on with viruses. Many viruses attack the boot sector, or could mess up your partition table. If you do have a dual booting system, make sure that your Windows boot is well protected as some viruses can render the entire system unusable.

happened here and essentially killed my husbands desire to have anything more to do w/ windows, he now has a windows free box ( yay!! ) about a year ago he got some sort of virus that messed w/ the boot sector enough that the box thought it didn't even have enough room to install Dr. Dos 5 or so.. ! And, of course, he lost everything in his Linux partition because we could only get the entire disk back by fooling the boot partition into thinking it was going to be reformatted , again! and that screwed his chance to save his work for the day.. took me 9 hours to bring that box back up, but it was (Suse) Linux only and after a while he got a substitute for stuff that windows weenies use and they aren't going to catch anything if I can keep the mail filters going tightly. (He's not allowed to put a "strange" as in someone else's cd into the cdrom and no floppies that strange people send either. ) I'm considering getting rid of floppy drive altogether, except it does seem a be tter thing to use one w/ gpg info on it than leave that info on a box that *could* be touched by someone else. ( I can't lock him away, he doesn't like it <VBG> besides , it's probably against some convention or other to have someone locked into a room w/ no food or water or breaks for walks to a smaller room, if you guys get my attempt at delicacy there <G>) I do keep his box locked down as tightly as possible , remove anything he doesn't actually need. No apache ... no web creation crap, his website is done by a windows guy... need I say the site was down for the entire duration of the last worm? He thinks I'm weird, but I think he's weirder ... it's not the first time it's happened to him... he has another business ( diving and tours to exotic Islands and suchlike things .. so I'm not certain how diligent the patching is... but it doesn't connect to us here anyway.... so it's no my problem , mon ! Need I say I get a tad fanatical about patching? I don't want to ever go thru a day like that ever again. ( no sleep for several days leading up to the "event" didn't help either... made me real , um, cranky! ) -- j it's just an afterthought; okay ? : Midas was into golden showers.

On Thursday 04 September 2003 18:21, David Herman wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Thursday 04 September 2003 06:10 am, zentara wrote: - -----------snip----------------

...

Also, you know not to run "defrag" in windows, when you have a dual boot with linux. Many a linux system has been messed up by defrag.

Although I commiserate w/ those who have had this problem its not been my experience. Perhaps the problems are limited to specific m$ versions or filesystems.

In my experience, this problem arises is the windows partition is resized by Linux... Dylan -- Sweet moderation Heart of this nation Desert us not We are between the wars - Billy Bragg

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thu, 4 Sep 2003 10:21:17 -0700 David Herman wrote:

I have a multi boot system which is occasionally called upon to run win98. I've never had a problem on my other operating systems caused by defragmenting win98. There are 4 or 5 win partitions spread about my 2 drives (alongside 6 other bootable operating systems), they were all defragged about 10 days ago w/ no problem.

I also have win4lin but have never had the nerve to run defrag there (no sense pushing my luck) I have not run a recent copy of Win4Lin, but you probably could run defrag on a native FAT or FAT32 partition from Win4Lin, but do not do it on your virtual C: drive, which is a directory in your home directory.

One other potential dual booting issue WRT scandisk and defrag. I have seen cases where Windows may not fully respect the partition table. BTW: I run a multi-boot on my desktop system: 1. SuSE 8.2 (newly upgraded) 2. SuSE 8.1 3. Windows ME. I boot into ME ONLY when I need to talk to the Comcast Customer Service droids, and that is very rare. They only know direct connect and reboot. But, I do not run email or surf on that system. My laptops are 100% Linux. - -- Jerry Feldman Boston Linux and Unix user group http://www.blu.org PGP key id:C5061EA9 PGP Key fingerprint:053C 73EC 3AC1 5C44 3E14 9245 FB00 3ED5 C506 1EA9 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iD8DBQE/V5w2+wA+1cUGHqkRAkeSAJwKtMTjSQYFd9aJsQWi0nvvmLO9ZwCfU/Do PHGFEnmblpQXZvbaSbefoUo= =tZLq -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday 04 September 2003 01:50 pm, David Herman wrote:

- ----------snip-----------------

> My assumption has been that win4lins virtual drives (those in the
> home directory) are actually a sort of  "magical" re-direction to the
> linux filesystem that the files are kept on. Therefore
> defragmentation 

CORRECTION ...I meant fragmentation (ie de-fragmentation should not be 
an issue)

> should not be a problem, and that running defrag on
> these (emulated) drives would indeed be risky if not dangerous.
- --------snip------------
> See ya

- -- 
dh
Don't shop at GoogleGear.com!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE/V6bXBwgxlylUsJARAp/AAJ4wZ7Wf3VJchaDC8l9wdnI8mUH0pQCcDRsv
pMygEAt0qB9C2kcoJ2t5ktQ=
=UmKo
-----END PGP SIGNATURE-----

On Thursday 04 September 2003 09:10, zentara wrote:

On Wed, 3 Sep 2003 22:38:56 -0400

"Bob S." wrote:

...

On Wednesday 03 September 2003 07:18, zentara wrote:

...

On Tue, 2 Sep 2003 22:26:16 +0100

The biggest danger is if you have a dual boot with windows and linux. <snip>.

Whoa !! Are you saying that in a dual boot system a windows virus can infect the Linux partitions? Windows doesn't even know that Linux is there and they are different filesytems, FAT32 vs ext3. Mine are even on different hard drives.

Please tell us a little more. My Win 98 system is a mess, no virus protection, nothing, and don't really care. Only keep it to run a few games and some Flight Planning software.

I'm sorry to dissapoint you, but you can have some real damage done by the windows kernel running. It may not know how to read ext3 but it knows something is there. Just do an fdisk in windows.....do the linux partitions show up as "unknown" or "not there".

Sadly a virus can be written to do anything anywhere on the disk, only if the linux kernel is running, will it observer "permissions" and the programs right to write to some area of the disk. Windows observes no permissions. So a windows virus can say write a bunch of 1's at some place where the ext3 filesystem is. Then you get file corruption, and if it targets the boot area, you may not be able to boot.

Also, you know not to run "defrag" in windows, when you have a dual boot with linux. Many a linux system has been messed up by defrag.

Yep, knew that & don't --Hence the "mess" I mentioned.

It's also becoming possible, for very clever trojans to be introduced into linux, from running windows. Say for instance, a clever windows hacker wrote a virus which scanned linux partitions for libc.so.6 and modified it somehow. Then everytime you ran a program back in linux, you could be spreading something injected by windows.

The lesson? Do not have dual boots with windows, if you need security. Dual boots are risky business.

Thanks to all for all of the scary replies. You all have made me very nervous. I have been OK so far, and since I NEVER download anything including e-mail into windows, let alone use unknown flopppies or CDs anymore, I suppose I will be safe until I can finally dump windows. One more question though, (In the interest of installing my specialized windows only programs in Linux, if they will work), If I use a "stand alone" wine, (without using the real windows registry etc.) will that also be vulnerable?? Bob S.

Hello ppl, how are you ? I hope you are ok. I would like to say thanks to everybody who sended mails and shared their kwnoleged. The information that i gathered here is excelent, thanks a lot. Best Regards Marco Oliveira On Friday 05 September 2003 05:14, Bob S. wrote:

On Thursday 04 September 2003 09:10, zentara wrote:

...

On Wed, 3 Sep 2003 22:38:56 -0400

"Bob S." wrote:

...

On Wednesday 03 September 2003 07:18, zentara wrote:

...

On Tue, 2 Sep 2003 22:26:16 +0100

The biggest danger is if you have a dual boot with windows and linux. <snip>.

Whoa !! Are you saying that in a dual boot system a windows virus can infect the Linux partitions? Windows doesn't even know that Linux is there and they are different filesytems, FAT32 vs ext3. Mine are even on different hard drives.

Please tell us a little more. My Win 98 system is a mess, no virus protection, nothing, and don't really care. Only keep it to run a few games and some Flight Planning software.

I'm sorry to dissapoint you, but you can have some real damage done by the windows kernel running. It may not know how to read ext3 but it knows something is there. Just do an fdisk in windows.....do the linux partitions show up as "unknown" or "not there".

Sadly a virus can be written to do anything anywhere on the disk, only if the linux kernel is running, will it observer "permissions" and the programs right to write to some area of the disk. Windows observes no permissions. So a windows virus can say write a bunch of 1's at some place where the ext3 filesystem is. Then you get file corruption, and if it targets the boot area, you may not be able to boot.

Also, you know not to run "defrag" in windows, when you have a dual boot with linux. Many a linux system has been messed up by defrag.

Yep, knew that & don't --Hence the "mess" I mentioned.

...

It's also becoming possible, for very clever trojans to be introduced into linux, from running windows. Say for instance, a clever windows hacker wrote a virus which scanned linux partitions for libc.so.6 and modified it somehow. Then everytime you ran a program back in linux, you could be spreading something injected by windows.

The lesson? Do not have dual boots with windows, if you need security. Dual boots are risky business.

Thanks to all for all of the scary replies. You all have made me very nervous. I have been OK so far, and since I NEVER download anything including e-mail into windows, let alone use unknown flopppies or CDs anymore, I suppose I will be safe until I can finally dump windows.

One more question though, (In the interest of installing my specialized windows only programs in Linux, if they will work), If I use a "stand alone" wine, (without using the real windows registry etc.) will that also be vulnerable??

Bob S.