1

After running clam it found four files called win.trojan.Xored-1

What are they? They were in Chrome cache.

  • They must be trojans, downloaded from sites. But I do not think they can affect Ubuntu. – Pilot6 Mar 17 '16 at 14:16
  • This is very unlikely. I have a friend who offers a money bonus for someone who sends a WORKING virus for linux that does not need a long manual to install ))) – Pilot6 Mar 17 '16 at 14:19
  • @Zacharee1 Mother of god... – David Mar 17 '16 at 14:19
  • @Pilot6 There are quite a few articles on it. Search the ID OP provided. – TheWanderer Mar 17 '16 at 14:20
2

According to this article, They are files from a rather dangerous Trojan virus and rootkit.

The Trojan, called XOR.DDoS installs itself onto compatible Linux systems and hides its files so the user doesn't know it's there. It uses your computer to run DDoS attacks.

However, it relies on you having not changed any default logins on your devices, which means if you have a password you're probably OK. I would delete those files and maybe look into removing rootkits just in case, however.

The Avast blog has a more detailed article on it: https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-embedded-rootkit/

  • Oddly I have never used any default logins - system has always been password protected. Thanks for the article - will check it out. I just deleted all odd files clam found including some html.exploit.CVE files and scanned again. – danielp Mar 17 '16 at 14:31
  • @danielp I still recommend checking for rootkits: apps.ubuntu.com/cat/applications/precise/chkrootkit – TheWanderer Mar 17 '16 at 14:35
  • I got this: Searching for Suckit rootkit... Warning: /sbin/init INFECTED – danielp Mar 17 '16 at 14:50
  • Does this application allow you to remove rootkits? – TheWanderer Mar 17 '16 at 14:52
  • I ran chkrootkit so no I don't think it does - or at least I don't know how to remove – danielp Mar 17 '16 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.