Home / ubuntu / Questions / 1086572
Accepted
RJ Adams
Asked: 2018-10-24 17:07:12 +0800 CST

I ran ChkRootkit and came up with a infected file. I need help

  • 772

So I ran a chkrootkit. I have linux.xor.ddos showing as infected. I read other forums online and I have seen things mentioning false positives. What is linux.xor.ddos file and how can I check if they are fine?

chkrootkit

2 Answers

  1. Best Answer

    Binaries in /tmp are flagged as "linux.xor.ddos" regardless of if they're infected or not. This was the case with the poster.

    • 3

  2. Any file under temporary folder marked as executable will raise a flag.

    enigma@t495:/tmp$ touch virus
enigma@t495:/tmp$ chmod +x virus
enigma@t495:/tmp$ sudo chkrootkit
Searching for Linux.Xor.DDoS ... INFECTED: Possible Malicious Linux.Xor.DDoS installed
/tmp/virus
    • 1