So I ran a chkrootkit. I have linux.xor.ddos showing as infected. I read other forums online and I have seen things mentioning false positives. What is linux.xor.ddos file and how can I check if they are fine?

  • Where is the file located? What is its name? We need more information. Commented Oct 24, 2018 at 9:50
  • I'm not sure exactly what linux.xor.ddos files are, how would I be able to locate it?
    – RJ Adams
    Commented Oct 24, 2018 at 10:02
  • I thought chkrootkit would have told you. However, a bit of googling showed that chkrootkit reports any binary that's in /tmp as linux.xor.ddos. Check and see what is in that directory. Commented Oct 24, 2018 at 10:07
  • So Linux.xor.ddos is malware, should I remove this vpn, or is this common to happen?
    – RJ Adams
    Commented Oct 24, 2018 at 10:22
  • A VPN shouldn't really install in to /tmp. What VPN are you using? Commented Oct 24, 2018 at 10:23

2 Answers 2


Binaries in /tmp are flagged as "linux.xor.ddos" regardless of if they're infected or not. This was the case with the poster.


Any file under temporary folder marked as executable will raise a flag.

enigma@t495:/tmp$ touch virus
enigma@t495:/tmp$ chmod +x virus
enigma@t495:/tmp$ sudo chkrootkit
Searching for Linux.Xor.DDoS ... INFECTED: Possible Malicious Linux.Xor.DDoS installed

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .