7

I am not an expert in information security. I am running Lubuntu on a laptop. Today, I ran chkrootkit and it printed the following:

INFECTED: Possible Malicious Linux.Xor.DDoS installed
/tmp/clamav-71d2ee99f7e011424ab238571d720a88.tmp

I did run clamscan. This is the first time I have seen this notice. I could not find any other reporting on it. Is this a known false positive, or does it represent a genuine intrusion -- and if it is the latter, is the proper response to just go in and delete that .tmp file?

2
  • There is absolutely nothing known here except this error message. It is unknown what the content of the file is and thus of this is a false positive or not. Apart from that: this site is about broader topics on information security and not about debugging possible individual infections. But if your system really is infected than just deleting the file will at most (if at all) delete the actual infection but will nothing do to close the attack vector which made the infection possible, i.e. a re-infection is likely. Aug 21, 2020 at 3:33
  • 1
    I appreciate what you're saying. I can't say it's wrong, but it does seem like people ask some pretty specific questions here. One security program (chkrootkit) was identifying a file from another (clamav) as malicious. Yes, I was alarmed, but it did seem to touch on a bigger issue -- one I could find addressed nowhere else. The universe of people interested in information security extends to people with different abilities: human-rights investigators, activists, who are doing what they can to keep their work secure. Even though you didn't like my question, I'm grateful you engaged. Thanks. Aug 21, 2020 at 23:57

2 Answers 2

4

Probably it's a false positive as the clamav temporary file /tmp/clamav-71d2ee99f7e011424ab238571d720a88.tmp will contains some signature of malware, these signatures can be detected by chkrootkit and flagged as malicious.

1
  • Thanks. I suspect you're right. When I ran a scan the next day, the temp file was gone. Aug 21, 2020 at 23:59
2

Most likely it is a false-positive. Note that any executable file in the temp directory will trigger the "INFECTED: Possible Malicious Linux.Xor.DDoS installed" warning.

For instance, if you manually add an empty, executable file in /tmp, you will get the INFECTED warning.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .