I am talking about AV scanners that are meant to scan for Linux Desktop systems, such as rkhunter. These scan for known Linux rootkits/worms/malware. But if they are known, shouldn't your system already be patched to defend them?
And another question that is due to my ignorance on antivirus. How do viruses work on Windows? Since the scanner is scanning known malware signatures, shouldn't Windows already have security that defeats the malware? Obviously I am missing something.
The misconception here is that exploitation isn't always a part of an infection. When an os is being patched it is being protected against a bug that might allow an attacker to infect a computer. But an attacker doesn't need to use a bug to gain access, and if he does use a bug it isn't necessarily part of the os (might be in an installed service, browser, app). Think about using social engineering, using a password you obtained somehow, or even using a browser exploit which is agnostic to the os version as you only exploit the browser's process.
Virus scanners add another layer of protection, if the malware was installed using credentials, social engineering or maybe even a zero day, if it is known you will still stop it.
As a concept security is always built in layers, assuming that the more obstacles you put attackers will have a harder time, which assuming you are not a high enough value target will make you an undesirable or practically safe.
The purpose of a virus scanner is to identify and delete/block executable programs that are malicious. This is separate from the problem of ensuring that such a malicious program doesn't get on your machine in the first place. In fact, a given malicious program could be placed on your machine through any number of exploits, but the program itself is what does damage. Scanning files before they are executed prevents many malicious programs from executing, regardless of their source.
Malicious programs aren't necessarily as obvious as "rm -rf /" either. Consider a program that encrypts your home directory and then deletes the unencrypted version (in hopes of getting you to pay a ransom). This program isn't exploiting anything- it's opening and reading files (which is a normal thing for a program to do), then it does some computation, and then it writes to another file (which is also normal). Even deleting files is a relatively routine thing for programs to do. Thus the need for identifying malicious programs as opposed to identifying programs that just delete files.
Original author of rkhunter here.
The comparison with a Windows systems and Linux are equal: you still need an antivirus scanner, even if you installed all available patches. Simply because malicious software can run on top of a fully patched operating system. So you need defenses in different areas. And while many say Linux is not really vulnerable to malware, I can tell you the opposite. The only question is what type of scanner you need (real-time on-access scanner or scheduled).
An attacker might use an unknown or zero-day exploit (against which your OS has not yet been patched) in order to install a known rootkit. So the virus scan is still worthwhile even if your patching is up-to-date.
