So I have clamav the antivirus but is that a protection against rootkits or do I need to install rootkit hunter as well with clamav?

  • 1
    @Zacharee1 That's a discussable opinion. The level of security you need always depends on your actions and you level of paranoia and although there might be less viruses against Ubuntu systems than against Windows systems, it's still recommendable to have antivirus software. At least e.g. if you're downloading stuff you later transfer on Windows machines, it's great to be able to scan it first. Also, malicious email attachments can reach your inbox without any shady actions from your side. You see, I strongly disagree with your advice. – Byte Commander Jan 8 '16 at 17:09
  • However, my level of paranoia hasn't made me worry about rootkits yet, so i can't give a definitive answer for that. But I'll call the paranoia expert in to share is panda-fu with you! ;D – Byte Commander Jan 8 '16 at 17:10
  • @ByteCommander works for me :) – TheWanderer Jan 8 '16 at 17:10
  • 1
    @Zacharee1 Google uses Ubuntu (server) also scans the data it receives and share ( the downloads you do) with anti-virus – Edward Torvalds Jan 8 '16 at 17:14

Clamav only acts as an anti-virus, and does not protect you against rootkits. In the opinion of most people viruses are not such a big threat on Linux, however we can all agree that rootkits are so it is good to protect yourself against them.

Though rkhunter will need to be installed on a fresh install before any software or updates are installed because it looks at changes in the system, and assumes the system it is installed on is safe, and then compares that to the system's state later on when you do a scan. So if you have a rootkit already, and you install rkhunter, it won't be able to tell if you have one or not.

Another option is OSSEC HIDS (Host Intrusion Detection System - which is not required to be installed on a fresh install, and will be able to detect a rootkit on a system even if it is installed after the rootkit (in most cases)) which can detect rootkits as well as a larger range of system activities.

  • So rkhunter is important for security? – Henry WH Hack v3 Jan 8 '16 at 23:52
  • 3
    @HenryWHHack: Yes, rootkits are a major threat in and outside the Linux world so it is very important to protect against them, because they actually make your system hide them (and potentially other malware) so without a program such as rkhunter you won't know that they are there, and they can even be used to hide malware which ClamAV would otherwise detect. They can even completely disable all of your protection while making your computer say that all is well. – user364819 Jan 9 '16 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.