Virus in F.I.R.E?

profhig · Joined: Sep 06, 2003 Posts: 239 Location: Tamworth, UK

I have decided to give linux a go and downloaded a few different bootable CD versions to try. I downloaded fire-0.3.5b.iso at http://fire.dmzs.com/?section=main. A BitDefender online scan identified 21 viruses in 52 files in the .iso. A scan at Panda and my own AVG identified nothing, so I am thinking they are false positives. However, I would like this confirmed by experienced users. I am aware that this is a forensic version of Linux, and as such will contain virus identities etc and it is probably these being falsely identified as malware. But I would like somebody who knows and can be trusted to tell me I am right before I let it loose! I have the saved scan results if anybody would like to see them. Thanks in advance.

nlinecomputers

Fire is a legit distro. As you said it has virus definitions in it. To confirm that the ISO is legit get the MD5 and run it on the disk.

profhig · Joined: Sep 06, 2003 Posts: 239 Location: Tamworth, UK

Thanks. Did what you said and the MD5's matched, so presumably all is O.K. Thanks again.

goretsky

Hello,

I asked one of my employer's malware researchers to take a look at this Linux distribution (the company I work for makes security software) and received a report back that because some of the the forensice tools on it can be used for malicious activity that these were probably being flagged. There probably is a setting in the anti-virus program you tried to look for applications which can be used for legitimate as well as malicious purposes, and this was enabled during those scans.

Regards,

Aryeh Goretsky

profhig · Joined: Sep 06, 2003 Posts: 239 Location: Tamworth, UK

Thanks, goretsky. I had done several scans, as I usually do after a download, including three online scans and only the BitDefender online scan showed anything. I am pretty happy now that all is well. Thanks again.