Talk:Linux malware

message: Linux/Lupper is not a Linux virus...it doesn't affect the Linux kernel or any GNU tools.  It attacks poorly written (and outdated, mind you) PHP and CGI blogging scripts.  If you were to place it under the category of a Linux virus, that would also mean that Windows and the Mac OS are also vulnerable.  This is fallacy.
:You didn't sign. And I'm not a citeable person, no blog or anything. But attacking the kernel itself is actually quite rare. It's much more common for a virus or exploit to attack software running on the target machine. So yes, that's a virus. And yes, Windows and Mac OS are also vulnerable. Look at the Pwn2Own competition for an example, most of the attacks can be used on any of the OS's. I don't have a source, haven't bothered looking to be honest, but to reject something as a virus because it does not attack the kernel is naive. Chrissd21 (talk) 03:20, 6 October 2009 (UTC)
replies: text: Read above: or any GNU tools. PHP and CGI scripts are not part of the operating system. Of course it may be worth mentioning that Linux doesn't make third party add ons safe (and neither do the Linux distributions). --LPfi (talk) 00:26, 7 October 2009 (UTC)
thread_title:  Linux/Lupper not a Linux vulnerability 

message: Many linux virus scanners are actually designed to stop windows viruses passing through linux email servers  —Preceding unsigned comment added by 86.16.160.17 (talk) 22:03, 3 January 2008 (UTC)
thread_title:  Email 

message: The list here is a small fraction of the viruses out there, and years out of date.  There are virus databases that have current info on that subject.  What should be the fate of the article?  I'm considering a move to "Notable Linux computer viruses".  Presumably virus notability comes under WP:SOFTWARE, although the criteria don't quite fit.  Probably only viruses with mainstream press coverage really are notable.  Comments? --John Nagle 17:53, 20 April 2006 (UTC)
replies: text: Agree too. An outdated list is misleading, as users may infer it is an exhaustive list. --Outlyer 17:17, 29 June 2006 (UTC)

text: The maybe viruses should be replaced by malware. --Outlyer 17:17, 29 June 2006 (UTC)
thread_title: Proposed move

message: I agree that this list is uninformative und would better be integrated somewhere else. I have nto fully understood, what your proposed article aims at: More warning about current virii -or- a sort of tracked list of virii (for example with a date of 1st occurrence and a date since when it is fixed in the distributions)? I personally would opt for the 2nd one because it provides it can provide an archive as well, thus replacing this outdated article nicely. -- And the list is not supposed to grow fast, I assume. ;-) Madmaxx 21:54, 25 May 2006 (UTC)
replies: text: Agree too. An outdated list is misleading, as users may infer it is an exhaustive list. --Outlyer 17:17, 29 June 2006 (UTC)

text: The maybe viruses should be replaced by malware. --Outlyer 17:17, 29 June 2006 (UTC)
thread_title: Agree

message: The following quote from the article makes a very silly assumption....
Like other Unix systems, Linux implements a multi-user environment where users are granted specific privileges and there is some form of access control implemented. As such, viruses typically have less of an ability to change and impact the host system. That is why none of the viruses written for Linux, including the ones below, have ever propagated successfully to a large number of machines. Also, the security holes that are exploited by the viruses have been fixed shortly after (or more often, before) the viruses started spreading. So the viruses listed no longer pose any concern as long as the Linux system is updated regularly.
Malware does not need "root" access to a linux machine to spread itself. For example, no special privileges are needed to send an email with an attachment out, or download a file from the internet. As to vulnerabilities, most malware is spread via social engineering, not software vulnerabilities, and even if vulnerabilities are patched right away there is still the problem of users not installing security updates in a timelyt manner.
Like most writing about computers security on the net I've seen on the net, this article is oversimplifying a very complex subject.
I won't try to make a correction, since I think this article shouldn't exist or should be integrated somewhere else.
Have a great day! :)
Toadlife 01:01, 30 October 2007 (UTC)
thread_title:  Multi-user does not prevent spread of malware / Article oversimplifies a complex subject 

message: Perhaps the advice should be included that a on-acces virusscanner is not required given that:
*so little linux virusses exist and 
* given that due to permission restrictions even these can do little harm
Instead, regular or monthly schedualed virusscanning would suffice (and offcourse no firewall or other implementations regularly seen with Norton Antivirus, ... is required.
Hope you include this advice (would make sure linux is not made sluggish by inexperienced users. Cheers,
81.246.132.145 (talk) 16:51, 27 December 2007 (UTC)
replies: text: Re-wrote it to be more encyclopedic, there shouldn't be a list or even guide lines on protection. Wolfmankurd (talk) 02:19, 29 December 2007 (UTC)

text: Wait.. You removed any mention of a firewall? *cringes*
Think of it like this. Your machine is a house, you're holding a party. The firewall is the bouncer, he makes sure that all the suspicious and unruly crowds are turned away at the door BEFORE THEY GET IN!!!. The antivirus is your doting father with a notepad, on that notepad are photos of people he thinks you shouldn't be hanging around with. Anyone who's face matches a photo will be kicked out.
You want to stop a threat BEFORE it gets into your machine. And that list only works on known viruses. No offence, but your an idiot and lacking a great deal of knowledge if you say that people should run an antiviruse programs (AV from now on) and no firewall.
If you're going to include references to AV's, then you need to at least link to IP Tables, or a third party firewall for Linux systems. 
http://www.milw0rm.com/platforms/linux
Above link is a list of Linux malware, as you can see, the most recent in there as of 06/10/2009 is 2009-07-14. And this list isn't little known malware, it's about big bugs. Both an AV and properly configured firewall/IP Tables are important to safe computing. Wrong topic but most viruses won't attack the kernel, they attack software, and the one thing consistent about a Linux distro is that it will be running certain software on it. If this article is a list only, an encylopaedic archive, then there is no need to mention AV or firewalls. If you are going to include a list of AV's, then at the very least include a link to IP Tables with something like "it is also reccomended the user properly configures IP Tables or installs a 3rd party firewall as they offer protection from more than just malware, and do not show a marked decrease in performance on the machine". And if the user only runs a scan for viruses once a week or so, then they are getting all the protection from the AV and no decrease in performance.  —Preceding unsigned comment added by Chrissd21 (talk • contribs) 03:52, 6 October 2009 (UTC)
thread_title:  Guideline on linux virus protection 

message: AFAIK there has never been a (successful) attack on the Ubuntu mirrors, and the following seems to confirm this:
https://lists.ubuntu.com/archives/sounder/2006-July/008231.html  —Preceding unsigned comment added by 213.118.46.230 (talk) 01:45, 18 February 2008 (UTC)
replies: text: I can't find any info either to confirm this ever happened. I believe it may have been put in the article in error. Besides that a mirror attack is not relevant to this article on viruses. I will removed it as "unsourced" - Ahunt (talk) 12:40, 20 February 2008 (UTC)
replies: text: So what?  Ubuntu is not Linux, it is *one* Linux distro, only.--72.218.114.15 (talk) 04:13, 11 October 2008 (UTC)
thread_title:  No attack on Ubuntu mirrors? 

message: Since this article contains a lot more information than just a simple list of Linux viruses I am wondering if the article name shouldn't be changed to something more along the lines of "Linux computer viruses and worms" to better reflect the content? I would like some input from other editors watching this article to get a consensus on this. - Ahunt (talk) 12:20, 6 March 2008 (UTC)
replies: text: I agree that the name should be changed. I'd suggest "Linux malware", as malware includes viruses and worms, and also spyware, etc. WalterGR (talk | contributions) 11:21, 8 March 2008 (UTC)
replies: text: That is a nice short title! I like it! Anyone else have any thoughts on this? - Ahunt (talk) 15:24, 8 March 2008 (UTC)
replies: text: Lacking any objections to renaming, I will go ahead and carry it out. - Ahunt (talk) 11:41, 10 March 2008 (UTC)
replies: text: Thanks for doing that! WalterGR (talk | contributions) 12:01, 10 March 2008 (UTC)
replies: text: No problem - thanks for suggested the best name! I changed all the links to it that I could find as well. - Ahunt (talk) 14:13, 10 March 2008 (UTC)
thread_title: Article name

message: I removed the Granneman quote.
* It's quite old (from 2003) and was written when Windows XP was Microsoft's main consumer OS.
* As such, it doesn't take e.g. Vista into account, where the user isn't admin by default.
* Some pretty important portions of the article were incorrect, and later corrected.
* The article is largely about Windows susceptibility to e-mail attachments containing malware, rather than the security/insecurity of the platform as a whole.
I'm sure there are better references out there for why malware isn't as common on Linux.
WalterGR (talk | contribs) 06:37, 8 March 2008 (UTC)
replies: text: No problem, if you think the quote is not helpful then it should go. I have changed the ref on the remaining quote so that the footnote works right. I have also removed the one-source tag, since there are currently three refs. I will also probably work on the external links in the list as they should be refs as well instead. - Ahunt (talk) 21:12, 8 March 2008 (UTC)
replies: text: Thanks for fixing the broken ref!  I just did "preview" on the section I edited so I didn't notice I had screwed it up. :/ WalterGR (talk | contributions) 21:15, 8 March 2008 (UTC)
replies: text: That is the one problem with "section editing" - you don't see the refs! - Ahunt (talk) 22:17, 8 March 2008 (UTC)
thread_title:  Removal of the Granneman quote 

message: I think the article is too oversimplifying in the sense that it neither gives a non-techical user information about the real threat-level his/her gnu/linux system (this article doesn't even draw a clear line between the kernel and user-mode program) nor for technical users an overview of possible malware categories. Fri Apr 11 14:13:43 CEST 2008  —Preceding unsigned comment added by 130.60.228.144 (talk) 12:15, 11 April 2008 (UTC)
replies: text: Feel free to expand it to make it better, as long as you have references! - Ahunt (talk) 13:10, 11 April 2008 (UTC)
thread_title:  Misc Comments 

message: It's a Unix-like system, but it's not Unix.  It's based on Minix, which also is not Unix.  —Preceding unsigned comment added by 72.244.63.65 (talk) 21:57, 3 July 2008 (UTC)
replies: text: No, but that's a red herring here.  Any Linux Standard Base system meets the same criteria as the Single Unix Specification -- since that's the underpinning of LSB -- and could therefore *legally* be called Unix if someone wanted to pay for the formal test suite to be run by SUS's owners, The Austin Group.  Therefore, it's pretty reasonable to say that Linux *is* UNIX, certainly in the general sense in which we say that BSD, SCO, or Solaris are, but in the more specific "UNIX is a registered trademark" sense, as well.--Baylink (talk) 22:24, 14 November 2009 (UTC)
thread_title:  Linux is not Unix 

message: Is it really impossible to get a reasonable estimation of the market share of Linux from a quality source? My googling doesn't return anything good.
The hitlink reference now used doesn't tell what was measured or how it was measured. I suppose it tells about operating systems used for browsing, but whether clients are counted based on hits, sessions, individual users, individual hosts or something else isn't reported, neither how (or whether) the estimates are corrected for obvious errors (is there some explanation somewhere on the site?).
I suppose these statistics are collected and put on the net primarily to advance use of the firm's technology, and so the site is interested in good-looking statistics, not in reporting the problems involved, and not necessarily in the correctness of the figures.
Apart from that, share in different markets is interresting for makers of different malware. Exploiters of browser bugs would be primarily interrested in individual browswer's market share, those using worms probably in server market share and so on.
I think market share (in different markets) indeed is important for writers of malware, but research discussing how important that is, and what other factors there are, would of course be interestesting.
--LPfi (talk) 10:17, 6 September 2008 (UTC)
thread_title:  Linux Market Share 

message: in the 1st paragraph
"The Linux operating system, Unix and other Unix-like computer operating systems are generally regarded as well-protected against computer viruses.[1] There have been successful attacks, however, on both Linux and Unix systems, the most notable perhaps being the Cuckoo's Egg attacks on Unix systems in the 1980s."
The cuckoo's egg attack was a hacker breaking into unix systems in the 1980s, before linux was even conceived. it is not suitable for this article on linux malware and should be removed. Xavier Orr (talk) 02:16, 26 September 2008 (UTC)
replies: text: I agree it is not relevant - removed. - Ahunt (talk) 11:34, 26 September 2008 (UTC)
thread_title:  Cuckoo's Egg attack not on linux 

message: Do most/all Linux anti-virus tools scan just for Linux viri, or all known including windows?  If I boot a Linux livecd to rescue a windows system, will it find the windows infections if it includes antivirus tools?  These kinds of OS-related and cross-OS matters should be mentioned in all of the antivirus articles.  Including virtual OSes running within the same and other OSes, and simpler matters like WINE within Linux... -69.87.199.190 (talk) 21:21, 2 December 2008 (UTC)
replies: text: That is a good question and you are right, the article should address it. There are so few Linux viruses and none in the wild right now that a Linux-virus-only scanner wouldn't be much use, so Linux scanners like AVG and ClamAV scan for all known viruses, that is to say mostly Windows viruses. These are mostly used on Linux mail servers anyway, where they might be forwarding mail onto Windows PCs - Ahunt (talk) 00:31, 3 December 2008 (UTC)
replies: text: I managed to find a ref and add a paragraph to the article. I hope that answers your question? - Ahunt (talk) 00:42, 3 December 2008 (UTC)
thread_title:  cross-OS antivirus aspects 

message: I removed this: One of the vulnerabilities of Linux is that many users think it is not vulnerable to viruses. Tom Ferris, a researcher with Mission Viejo, California-based Security Protocols, said in 2006, "In people's minds, if it's non-Windows, it's secure, and that's not the case. They think nobody writes malware for Linux or Mac OS X. But that's not necessarily true ..."
Who are those people who believe that nobody writes malware for Linux? He just made them up. There are people who believe that virus are a non-issue on Linux -- I'm one of them. We certainly don't believe there's no malware, however. The problem is that this guy, along with many other trying to sell their snake-oil, equate virus with malware when it suits them. Antivirus software generally only protect about actual viruses, not other classes of malware. Niczar ⏎ 19:15, 22 May 2009 (UTC)
replies: text: Niczar.. Wtf was that? Virus is a subtype of malware. To say malware is perfectly acceptable. And the "if it's not MSFT based it's secure" is a very common mindset. Why was that comment removed? It could have been the saving point of this page. As it is, all I see are biased editors who have no idea about what they're doing. Leave your bias outside before removing comments. If no-one objects, i'll place that comment back in. When I figure out the wiki rules on doing so of course.. Chrissd21 (talk) 04:16, 6 October 2009 (UTC)
replies: text: Well the proper response according to verifiability policy would be to say neither unless a proper source is cited. And even then, a proper source should be more than an editorial, but perhaps someone who's studied the prevalence or various malware. I'll see if I can look into it more.  —Preceding unsigned comment added by HamburgerRadio (talk • contribs) 04:46, 6 October 2009 (UTC)
thread_title:  Removed biased strawman quote 

message: Granneman quote at end of Linux malware#Anti-virus applications doesn't sit right. I found a better home for it just before Linux malware#Viruses and trojan horses.--Rfsmit (talk) 15:47, 14 July 2009 (UTC)
replies: text: Makes sense to me. - Ahunt (talk) 15:50, 14 July 2009 (UTC)
thread_title:  Moved quote 

message: Is not the real reason for a low malware count on Linux the fact that most distributions install software from a central repository  and the fact that Linux users are not using technologies like ActiveX, which appears to even more of an issue than Javascript and Java in MS browsers? This is also an advantage for any of the BSD variants and most UNIX systems in general. The real dangers for Linux still come from potential future drive by downloads due to bugs in the Javascript and Java in web browsers, so using noscript is really necessary for Linux as well I would think.  —Preceding unsigned comment added by 69.219.231.2 (talk) 05:30, 4 November 2009 (UTC)
replies: text: That is certainly one advantage, but the permissions environment certainly plays a big role as well. - Ahunt (talk) 12:47, 4 November 2009 (UTC)
thread_title:  Software Installation Method is the Linux Advantage Here 

message: Another reason for lack of viruses could be that it's hard to write a program that works on all Linux systems, and is easy to install everywhere. 
— Preceding unsigned comment added by Mainbegan1 (talk • contribs) 
: Probably true, but anonymous blogs aren't WP:RS. See also WP:SPS. If you have a reliable source this can be added in. - Ahunt (talk) 16:48, 6 February 2011 (UTC)
thread_title:  Deployment of programs (including viruses) on Linux is hard 

message: Why this comment is relevant: "These are the equivalents of User Account Control and Windows Update in modern Windows operating systems"?
It doesn't clarify anything, nor it needs to, the terms used in the article are generic and self explaining...
I'm removing the comment. --Ismael Luceno (talk) 13:32, 22 February 2011 (UTC)
replies: text: Removing that makes sense to me! - Ahunt (talk) 15:17, 22 February 2011 (UTC)
thread_title:  Irrelevant comments 

message: Reference 66 is a dead link. Not sure how to remove it.  — Preceding unsigned comment added by 77.75.187.116 (talk) 09:56, 26 May 2011 (UTC)
replies: text: Thanks for pointing that out. It isn't available on Archive.org so it gets tagged as per WP:LINKROT. - Ahunt (talk) 12:36, 26 May 2011 (UTC)
thread_title: Dead link

message: Seeing as though Android is Linux-based, should the vast cocktail of malware that has been written for Android be included here? It would definitely make sense, wouldn't it? --Kenny Strawn  —Preceding undated comment added 20:27, 10 August 2011 (UTC)
replies: text: It would, but if there is enough documented text perhaps it would be more useful to have an Android malware article linked from this one. - Ahunt (talk) 20:33, 10 August 2011 (UTC)

text: I'd leave it out. The Android kernel is not the same kernel that people use outside of Android when they use Linux, with large portions of the Android kernel being completely new -- the Android "linux" simply isn't what people get when they download the source from kernel.org. Any Android virus which doesn't actually exploit problems in the kernel is simply not a Linux virus -- also if it's not exploiting something that also exists in the mainline kernel, it's simply not relevant to Torvald's version.  — Preceding unsigned comment added by 80.162.60.16 (talk) 11:23, 26 January 2012 (UTC)

text: I think it should be left out, as detailed bellow. --SF007 (talk) 09:27, 13 March 2012 (UTC)
thread_title:  Should Android malware be included here? 

message: Since Android is based (albeit loosely) on Linux, I am asking for your opinions here: Should Android malware actually be included in this article, or is Android so different from upstream Linux that you don't think it's an issue? Thank you. Kenny Strawn (talk) 01:54, 7 March 2012 (UTC)
replies: text: We already had this discussion two sections up, but did not reach a conclusion. - Ahunt (talk) 13:05, 7 March 2012 (UTC)
thread_title:  Should Android malware be considered Linux malware? 

message: Is there any reason why an IP editor keeps reverting the see also list so it reads:
*List of computer viruses
*List of computer viruses (Numeric)
*List of computer viruses (A-D)
*List of computer viruses (E-K)
*List of computer viruses (L-R)
*List of computer viruses (S-Z)
Each one of these is a redirect to List of computer viruses. What is the point of having six links to the same article? - Ahunt (talk) 20:34, 29 September 2012 (UTC)
replies: text: Okay since there doesn't seem to be any immediate discussion on this topic I propose removing all these links but the first one, since they all redirect to the same place. - Ahunt (talk) 12:47, 1 October 2012 (UTC)
replies: text: With no objections or discussion for over a week, as per WP:SILENCE we have consensus to go ahead and remove these. - Ahunt (talk) 12:27, 9 October 2012 (UTC)
thread_title: See also list

message: IMHO there should be a separate section in the article talking about hosting-environments.
Thats because there is a bunch of Malware targeted to attack Hosting-Environments. As an example there are lots of PHP-Shells, like WSO and other. Once uploaded on a server they will help you gain further access or host malware on the compromised website.
These threads are quite different from those targeted at personal computers and unfortunately often neglected.
I think it is important to talk about this kind of malware, because to cut down the overall level of malware one step is to secure webservers and prevent them of being compromised and starting to distribute malware.
Usually the existing AV-Scanners are really bad at detecting stuff like that.
One Software, that was made to detect this kind of malware would be Linux Malware Detect.
It can be used in combination with ClamAV.
Here is a HowTo, that also includes a short statement in how Linux Malware Detect differs from common AV-Scanners.
Trumpf Puur (talk) 10:41, 19 November 2012 (UTC)
thread_title:  Malware in Hosting environments 

message: On the section Linux Vulnerability, Shane Coursen is quoted suggesting that the increase in Linux malware is a direct result of the increase in Linux usage, particularly as a Desktop OS. This is followed by a quote from Rick Moen that is said to "counter" the one from Shane Coursen. But reading the source, Rick Moen is actually addressing this question: "Isn't Microsoft Corporation's market dominance, making Linux an insignificant target, the only reason it doesn't have a virus problem?"
As you can see, he's responding to a statement that is almost the opposite of Shane Coursen's comment. Reading the two together makes Rick Moen sound deaf and distracted, but I can't think of a better way to phrase it. I'm just going to do a quick edit now, but if someone would like to restructure the section to make more sense, it is sorely needed. 12:18, 27 August 2013 (UTC)
thread_title:  Who counters what, now? 

message: I would like to have some of the content in
http://www.in2job.org/info/Malware#Linux
incorporated into this article, 
particularly the links to where to download Linux binaries from Comodo and ESET.
Plus, does anyone know how to obtain Sophos's client-side/end-user GNU/Linux binaries?
:Speaking of Sophos, they offer a "Cloud" anti-malware solution. This is an emerging thing that is part of the broader increase in Virtualisation / Cloud / Service-orientated architecture (trend in I.T.).
--Fleetwoodta (talk) 11:55, 11 June 2014 (UTC)
replies: text: I reverted your additions. External links are not used in article text and your additions fall afoul of WP:SPAM, WP:SPS and WP:EL. They are not appropriate to include. - Ahunt (talk) 18:28, 12 June 2014 (UTC)
thread_title:  Comodo and ESET Linux binaries 

message: Hello fellow Wikipedians,
I have just added archive links to  on Linux malware. Please take a moment to review my edit. If necessary, add  after the link to keep me from modifying it. Alternatively, you can add  to keep me off the page altogether. I made the following changes:
*Added archive https://web.archive.org/20080514013935/http://www.roqe.org:80/brundle-fly/ to http://www.roqe.org/brundle-fly/
*Added archive https://web.archive.org/20071028171058/http://www.viruslist.com/en/viruslist.html?id=3994&key=00001000050000200004 to http://www.viruslist.com/en/viruslist.html?id=3994&key=00001000050000200004
*Added archive https://web.archive.org/20071107040844/http://www.viruslist.com/en/viruslist.html?id=3135&key=00001000050000200003 to http://www.viruslist.com/en/viruslist.html?id=3135&key=00001000050000200003
*Added archive https://web.archive.org/20080621115415/http://www.f-secure.com:80/v-descs/lindose.shtml to http://www.f-secure.com/v-descs/lindose.shtml
When you have finished reviewing my changes, please set the checked parameter below to true to let others know.
Cheers. —cyberbot IITalk to my owner:Online 16:08, 18 October 2015 (UTC)
replies: text: - Ahunt (talk) 17:03, 20 October 2015 (UTC)
thread_title:  External links modified 

message: Hello fellow Wikipedians,
I have just modified 7 external links on Linux malware. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20120117122655/http://vx.netlux.org/lib/apf29.html to http://vx.netlux.org/lib/apf29.html
*Added archive https://web.archive.org/web/20120117122247/http://vx.netlux.org/lib/apf31.html to http://vx.netlux.org/lib/apf31.html
*Added archive https://web.archive.org/web/20120117121406/http://vx.netlux.org/lib/apf30.html to http://vx.netlux.org/lib/apf30.html
*Added archive https://web.archive.org/web/20120206235015/http://vx.netlux.org/herm1t/Lacrimae_EN.txt to http://vx.netlux.org/herm1t/Lacrimae_EN.txt
*Added archive https://web.archive.org/web/20120117122703/http://vx.netlux.org/lib/apf12.html to http://vx.netlux.org/lib/apf12.html
*Added archive https://web.archive.org/web/20070602061547/http://vx.netlux.org/lib/vmd01.html to http://vx.netlux.org/lib/vmd01.html
*Added archive https://web.archive.org/web/20120117122359/http://vx.netlux.org/lib/apf37.html to http://vx.netlux.org/lib/apf37.html
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 13:42, 16 May 2017 (UTC)
thread_title:  External links modified 

message: Hello fellow Wikipedians,
I have just modified 12 external links on Linux malware. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20080324042224/http://www.symantec.com/enterprise/security_response/weblog/2007/06/bad_bunny.html to http://www.symantec.com/enterprise/security_response/weblog/2007/06/bad_bunny.html
*Added  tag to http://service1.symantec.com/SUPPORT/ent-security.nsf/ppfdocs/2005110716014248
*Added archive https://web.archive.org/web/20080512082347/http://www.eset.com/products/linux_mail.php to http://www.eset.com/products/linux_mail.php
*Added archive https://web.archive.org/web/20080510143951/http://www.eset.com/products/gateway.php to http://www.eset.com/products/gateway.php
*Added archive https://web.archive.org/web/20130305191528/http://rootkit.nl/projects/rootkit_hunter.html to http://www.rootkit.nl/projects/rootkit_hunter.html
*Added archive http://webarchive.loc.gov/all/20110217010903/https://www.volatilesystems.com/ to http://www.volatilesystems.com/
*Added archive https://www.webcitation.org/65lFpGKJC?url=http://vx.eof-project.net/viewtopic.php?pid=1049 to http://vx.eof-project.net/viewtopic.php?pid=1049
*Added  tag to http://vil.nai.com/vil/content/v_130506.htm
*Added archive https://web.archive.org/web/20080302053542/http://www.symantec.com/enterprise/security_response/weblog/2007/04/the_ipod_virus.html to http://www.symantec.com/enterprise/security_response/weblog/2007/04/the_ipod_virus.html
*Added archive https://web.archive.org/web/20071107040802/http://www.viruslist.com/en/viruses/encyclopedia?virusid=21734 to http://www.viruslist.com/en/viruses/encyclopedia?virusid=21734
*Added archive https://web.archive.org/web/20071110002308/http://www.viruslist.com/en/viruses/encyclopedia?virusid=21756 to http://www.viruslist.com/en/viruses/encyclopedia?virusid=21756
*Added archive https://web.archive.org/web/20071030074550/http://www.viruslist.com/en/viruses/encyclopedia?virusid=23854 to http://www.viruslist.com/en/viruses/encyclopedia?virusid=23854
*Added archive https://web.archive.org/web/20071028171038/http://www.viruslist.com/en/viruses/encyclopedia?virusid=23856 to http://www.viruslist.com/en/viruses/encyclopedia?virusid=23856
*Added  tag to http://vil.nai.com/vil/content/v_136821.htm
*Added archive https://web.archive.org/web/20071107040820/http://www.viruslist.com/en/viruses/encyclopedia?virusid=23864 to http://www.viruslist.com/en/viruses/encyclopedia?virusid=23864
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 10:33, 10 December 2017 (UTC)
thread_title:  External links modified 

message: Hello fellow Wikipedians,
I have just modified one external link on Linux malware. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20130815040638/http://blogs.rsa.com/thieves-reaching-for-linux-hand-of-thief-trojan-targets-linux-inth3wild/ to https://blogs.rsa.com/thieves-reaching-for-linux-hand-of-thief-trojan-targets-linux-inth3wild/
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 22:09, 23 December 2017 (UTC)
thread_title:  External links modified 

message: Would be good if someone knowledgeable could add this at the right place in this entry. Thanks.  — Preceding unsigned comment added by Uflinks (talk • contribs) 14:53, 9 June 2019 (UTC)
replies: text: You will need to provide a ref so we know what you are referring to. - Ahunt (talk) 15:50, 9 June 2019 (UTC)
thread_title:  HiddenWasp malware targeted at Linux users 

message: What is the difference between the method of virus spreading in linux and windows 49.36.41.91 (talk) 04:20, 29 November 2021 (UTC)
replies: text: There is no basic difference, it is just that Windows is far more vulnerable to malware than Linux is. - Ahunt (talk) 13:16, 29 November 2021 (UTC)
replies: text: This reply lacks any proofs and talks about that as if it's common knowledge. It's not. We are in 2022, not in 2000. Artem S. Tashkinov (talk) 19:42, 5 June 2022 (UTC)
replies: text: Most of this article is stuck in the early 2000s. Aletheiatus (talk) 19:31, 22 November 2023 (UTC)
thread_title:  Linux and windows on virus 

message: Is mostly a load of "I want to believe in" "backed up" with dubious low-quality sources, to be precise blog posts from absolute no ones disguised as "reputable" sources in order to satisfy the WP rules on citation and verifiability. This paragraph is far outside of what Wikipedia stands for. Lastly, opinionated blog posts with no actual research or data cannot be used as reputable sources but whatever.
I'll leave my version here because it actually cites large well-known organizations doing Linux malware research:
 	
Linux-based devices have been implicated in a number of botnets. This is a direct result of many devices based on the Linux kernel lacking proper updates or means of installing them. The issue has been known for over a decade.
Extra fresh new highly reputable sources:
* https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/a-look-at-linux-threats-risks-and-recommendations
* https://hothardware.com/news/millions-of-home-wi-fi-routers-linux-exploits
* https://securityboulevard.com/2021/12/home-routers-are-full-of-security-bugs-patch-now/
* https://www.bleepingcomputer.com/news/security/nine-wifi-routers-used-by-millions-were-vulnerable-to-226-flaws/
The truth is outside of Linux servers (and many of them continue not to receive updates) there are literally millions of vulnerable Linux devices because no one is updating them or updates are no longer offered: WiFi routers, switches, IoT, etc. etc. etc. This issue has been known for over a decade but "There's no malware for Linux", yeah, right, except when hundreds of thousands of such devices are used to perform DDoS attacks or hack into networks. And what do all those hacked devices run? Right, malware which "doesn't exist". This article is afraid to talk about this issue because again, it's penned by the people who love fairy tales, not facts of life.
I will not touch any Linux related articles on WP ever again. Last time I did that 10 years ago, now it's my last time. I'm OK with fanboys on r/Linux, phoronix.com, LWN.net, etc. but seeing this on WP is kinda atrocious and disgusting. Artem S. Tashkinov (talk) 19:42, 5 June 2022 (UTC)
replies: text: Are you going to propose changes to the article or are you just here to rant? - Ahunt (talk) 20:01, 5 June 2022 (UTC)
replies: text: Challenging a dubious stale opinion with no relevant citations and research (blog posts by journalists do not count as a citation) while providing solid proofs backed up with a lot of industry recognized research is nowadays called "rant"? I don't have any proposals, oh, wait, it's the third paragraph of my comment. Artem S. Tashkinov (talk) 15:27, 6 June 2022 (UTC)

text: Please leave my comments intact and I don't care about this article any longer. I will never touch anything related to Linux on WP. Again, thank you for the insult of calling my valid objection and well researched edit a "rant". Artem S. Tashkinov (talk) 15:43, 6 June 2022 (UTC)
thread_title:  The second paragraph 

message: The article appears to have very outdated sources. A significant amout of sources is from the early 2000s and it is highly questionable how relevant they are still for the current situation. 
The main part of the article completly ignores iOT devices and Bot nets like Mirai, or maleware like Hummingbad, which both have an article on Wikipedia and both have infected multiple million devices. 
I do belive it would be more sencible to differentiate between maleware on IoT, Server, Android (as it is Linux based) and home usage. The current article does primarily focus on the home usage but kind of ignores the rest, which can appear very biased. Aletheiatus (talk) 19:29, 22 November 2023 (UTC)
thread_title:  Outdated sourcing and structure