I am talking about AV scanners that are meant to scan for Linux Desktop systems, such as rkhunter. These scan for known Linux rootkits/worms/malware. But if they are known, shouldn't your system already be patched to defend them?

And another question that is due to my ignorance on antivirus. How do viruses work on Windows? Since the scanner is scanning known malware signatures, shouldn't Windows already have security that defeats the malware? Obviously I am missing something.

  • 2
    "And another question...How do viruses work on Windows? " - please restrict yourself to a single and narrow question. Adding this second and broad question which has nothing to do with the title of the question makes this whole question too broad. Jun 28 '17 at 5:02

The misconception here is that exploitation isn't always a part of an infection. When an os is being patched it is being protected against a bug that might allow an attacker to infect a computer. But an attacker doesn't need to use a bug to gain access, and if he does use a bug it isn't necessarily part of the os (might be in an installed service, browser, app). Think about using social engineering, using a password you obtained somehow, or even using a browser exploit which is agnostic to the os version as you only exploit the browser's process.

Virus scanners add another layer of protection, if the malware was installed using credentials, social engineering or maybe even a zero day, if it is known you will still stop it.

As a concept security is always built in layers, assuming that the more obstacles you put attackers will have a harder time, which assuming you are not a high enough value target will make you an undesirable or practically safe.

  • "Virus scanners add another layer of protection, if the malware was installed using credentials, social engineering or maybe even a zero day, if it is known you will still stop it." I don't understand how these viruses could be "known", is 'rm -rf /' a piece of 'known malware' that a virus scanner could stop? Jun 27 '17 at 22:34
  • @Ninja-Rabbit you assume "rm -rf /" (or rather the machine code for it) is the only part of a binary that includes it. There are many parts of a file that can be analyzed. Specific commands can be analyzed but are not always the method of discovery.
    – Nalaurien
    Jun 28 '17 at 3:03
  • A malware is piece of software that is attributed to malicious use, almost all malware has benign usage (remote administration, collecting data about your employees). Since rm (like most benign files) has both malicious and benign use, but not used mostly for malicious usages it is a benign file. If you have a binary that deletes the entire file system and isn't part of a formatting tool usually used for it usages it might be classified as malware. Jun 29 '17 at 11:26

The purpose of a virus scanner is to identify and delete/block executable programs that are malicious. This is separate from the problem of ensuring that such a malicious program doesn't get on your machine in the first place. In fact, a given malicious program could be placed on your machine through any number of exploits, but the program itself is what does damage. Scanning files before they are executed prevents many malicious programs from executing, regardless of their source.

Malicious programs aren't necessarily as obvious as "rm -rf /" either. Consider a program that encrypts your home directory and then deletes the unencrypted version (in hopes of getting you to pay a ransom). This program isn't exploiting anything- it's opening and reading files (which is a normal thing for a program to do), then it does some computation, and then it writes to another file (which is also normal). Even deleting files is a relatively routine thing for programs to do. Thus the need for identifying malicious programs as opposed to identifying programs that just delete files.

  • And there exists a Linux virus scanner that would defeat ransomware? I thought the Linux scanners weren't "live" and if you didn't verify their hashes/scan them, it's too late once you execute them. Jun 27 '17 at 23:05

Original author of rkhunter here.

The comparison with a Windows systems and Linux are equal: you still need an antivirus scanner, even if you installed all available patches. Simply because malicious software can run on top of a fully patched operating system. So you need defenses in different areas. And while many say Linux is not really vulnerable to malware, I can tell you the opposite. The only question is what type of scanner you need (real-time on-access scanner or scheduled).


An attacker might use an unknown or zero-day exploit (against which your OS has not yet been patched) in order to install a known rootkit. So the virus scan is still worthwhile even if your patching is up-to-date.

Not the answer you're looking for? Browse other questions tagged or ask your own question.