Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a simple way to check whether or not my Ubuntu machine is part of a botnet?

share|improve this question
Put a sniffer on your network cable and watch if there is any in-/outgoing traffic without doing anything (and having internet browsers, mail, chat and torrent clients, ... closed) – Lekensteyn Oct 21 '11 at 19:29
Or just netstat -a with other things closed (including ubuntu-one as well) – belacqua Oct 21 '11 at 20:23
@Lekensteyn - the last time I sniffed my traffic (which I do regularly for debugging software I write), there was a mindboggling amount of things going on across a bunch of protocols. Depending on what network I'm on, there's even more. I, for one, have no idea what kinds of software do all that, and whether they are legitimate. Is there a list? – Hanno Fietz Jan 4 '13 at 11:10
@HannoFietz With the sniffer approach you will get a lot spam from broadcast traffic, with a wireless network you will see even more control messages. Assuming that a infected machine will regularly "call home", it should be sufficient to set a filter to capture outgoing traffic only. netstat was mentioned, ss may also be useful to you. – Lekensteyn Jan 4 '13 at 15:07

Install clam-tk and clam-av. This is a virus scanner and a GUI frontend, this will scan your Ubuntu machine for viruses, malware, and the like. Also helpful is the ability to scan windows partitions, helpful for dual-booters.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.