Is it possible for my Linux box to become infected with a malware?

I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true?

If so, what's up with Linux Anti-Virus (security) software?

  • 1
    Check out this quora answer: goo.gl/UVCsgz it covers the main reasons why Linux/Unix is different than Windows in terms of chances of being randomly infected by malware.
    – arielf
    Feb 4, 2015 at 1:39
  • 2
    Another article which I found informative, though not as good as the one @arielf linked: linuxmafia.com/~rick/faq/#virus
    – Wildcard
    Jan 21, 2016 at 19:59

9 Answers 9


First, it's certainly possible to have viruses under Unix and Unix-like operating systems such as Linux. The inventor of the term computer virus, Fred Cohen, did his first experiments under 4.3BSD. A How-To document exists for writing Linux viruses, although it looks like it hasn't had an update since 2003.

Second, source code for sh-script computer viruses has floated around for better than 20 years. See Tom Duff's 1988 paper, and Doug McIllroy's 1988 paper. More recently, a platform-independent LaTeX virus got developed for a conference. Runs on Windows and Linux and *BSD. Naturally, its effects are worse under Windows...

Third, a handful of real, live computer viruses for (at least) Linux have appeared, although it's not clear if more than 2 or 3 of these (RST.a and RST.b) ever got found "in the wild".

So, the real question is not Can Linux/Unix/BSD contract computer viruses? but rather, Given how large the Linux desktop and server population is, why doesn't that population have the kind of amazing plague of viruses that Windows attracts?

I suspect that the reason has something to do with the mild protection given by traditional Unix user/group/other discretionary protections, and the fractured software base that Linux supports. I mean, my server still runs Slackware 12.1, but with a custom-compiled kernel and lots of re-compiled packages. My desktop runs Arch, which is a rolling release. Even though they both run "Linux", they don't have much in common.

The state of viruses on linux may actually be the normal equilibrium. The situation on Windows might be the "dragon king", really unusual situation. The Windows API is insanely baroque, Win32, NT-native API, magic device names like LPT, CON, AUX that can work from any directory, the ACLs that nobody understands, the tradition of single-user, nay, single root user, machines, marking files executable by using part of the file name (.exe), all of this probably contributes to the state of malware on Windows.

  • 35
    One issue you brushed past that's worth considering is that the Windows ABI has remained stable for years. (Or rather, MS has gone to a lot of trouble to support all the various ABIs they've released transparently. WoW64, for example.) This means that an executable that runs on Windows 3.1 may well run on Windows 7. This makes for a monoculture within a monoculture: malware writers don't have to rebuild their programs for every version of Windows, as you often have to do for Linux. Oct 5, 2010 at 15:30
  • 51
    I think another reason for the low level of viruses in Unix/Linux and Mac systems is the presence of global package management systems, with trusted repositories configured by default. Whereas for Windows go online to download software from direct malevolent vendors they find while googling, on a unix/linux/mac you use your internal software to browse a repository where new entries are scrutinized and removed if problems are noticed.
    – haylem
    Dec 4, 2010 at 13:08
  • 33
    Also, Windows being the land of the proprietary (though that happens on other platforms, I'm looking at you Mac OS), people tend to look for cracked software for this platform significantly more than for others. And going in dark alleys online is no different than going to dark alleys in real life: expect troubles. How can you trust a drug dealers to provide what they advertise? And in an unmodified form? So how can you trust cracked software dealers to provide what they advertise? And without the software being modified?
    – haylem
    Dec 4, 2010 at 13:10
  • 5
    Also Data is separated from code and config files (var & home; bin & usr; etc). Look in Windows- Program Files- binaries, config files, data (MS SQL). You can mount dirs with no exec for data. Apps don't execute every file you trow at them (mail clients word processors). Open code for review. Quick fix for problems (check response time for RedHat and Debian guys after threat found in the kernel). When a problem found- the Distro pushes some update (I didn't realize for example- KDE is looking for +x flag on desktop shortcuts for example to execute them which feature was missing at some point)
    – jet
    Jan 10, 2011 at 18:07
  • 1
    Haylem's comment above is right on, it would be interesting to see if this is "game-changing" for reducing the "very secure" image of OSX Macs, now a few years later... I see mal-conditions on OSX almost everyday, because users have downloaded and installed cracked software (the average person not even shying away from executing 'file.sh' that opens in terminal, and typing their admin password!) Jul 26, 2016 at 17:45

It helps prevent the spread of viruses in Windows

Remember that Linux is used in many ways, such as file and email servers.

Files in these servers (MS Office files, outlook messages, EXE programs) can be stored with an infection.

Even though they should not affect the servers themselves, one could configure the server to check every file at the moment that is stored to make sure that it is clean and prevent future spread when they are moved back to a Windows machine.

I myself have it installed for when a friend asks me to check why their Windows machine is not working, or for when I plug my pen drive on a Windows machine.

  • 40
    +1 the real reason for the existence of AV software on linux, is not so much for scanning for problems that could affect the system, but for problems that could affect other systems (like windows). Oct 17, 2010 at 3:17
  • 1
    This should be an accepted answer. The rest of my household uses Windows. I feel it is safer to plug foreign flash drives into my Linux desktop, scan them, and then declare them safe for connecting to other machines in the home.
    – Johan
    Mar 15, 2013 at 9:24
  • That's a really cool point of view; many people use linux like that (usb), but probably never really realized there could also be an application-based scan for Windows viruses on Linux. Jul 26, 2016 at 17:48
  • 1
    I semi-infrequently reboot my Windows PC from a Linux USB drive so I can run AV scans. Apr 27, 2018 at 23:25

Viruses for Linux are possible in principle and there have been some, however in the wild, there are no widespread Linux viruses. The Linux user base is pretty small and under Linux it is much harder for a virus to do much harm as the user model is pretty restrictive in contrast to e.g. Windows XP. Therefore virus authors normally target Windows.

There is Linux Anti-Virus software, e.g. from McAfee, but no Linux user I know uses such software. It is by far more important to install only software from trustworthy sources and keep your system always up to date by installing security updates in a timely manner.

  • 3
    I would like just to add that even if you manage to get a virus (in my 10 years of Linux I never seen one) the worst scenario is that your user folder will be compromised. Oct 5, 2010 at 9:16
  • 37
    No, the worst scenario is complete system compromise. The kernel folk just closed a huge hole in the kernel about six weeks ago that would let any GUI program escalate their privileges to root level. Do a little Googling around, and you'll find other past holes of this nature. It's true that Linux has better security in a lot of ways compared to Windows, but like any other code base of millions of lines of code, you can be sure there are other holes in it waiting to be found. I, too, would advocate keeping systems patched rather than antivirus, but keep your head out of the sand, too. Oct 5, 2010 at 13:43
  • 6
    I have to differ with the "user base is pretty small" reason. The first really wide-spread PC virus was "Brain", in 1988. Surely Linux in 2010 has more desktop users than MS-DOS did in 1988. Why doesn't linux have more viruses, indeed, why doesn't it have a widespread "Brain" virus?
    – user732
    Oct 5, 2010 at 18:19
  • 8
    PCs achieved clear platform dominance right around 1988. The tallest nail gets pounded, then as today. Oct 5, 2010 at 20:40
  • 6
    echox is correct. AV software for linux, isn't really there to protect the linux system itself. it's there to scan files that linux is serving. Which is why most of these AV's only look at files they are directed to scan, instead of any file that's accessed or changes on the system. Oct 17, 2010 at 3:19

As a historical note, the first Internet worm, the Morris Worm, spread through vulnerabilities in Unix utilities. It predates Linux, but shows that it is possible for Unix based systems to be infected.

  • 3
    The Morris worm wasn't a virus, however. A virus must attach to some other piece of software, whereas the software Robert Morris wrote was in that sense independent. It was self-replicating but also self-sustaining, and thus a worm rather than a virus.
    – user
    Nov 29, 2013 at 13:56
  • @MichaelKjörling malware then?
    – Braiam
    Nov 29, 2013 at 18:56

In my opinion, there is one more reason, beside those mentioned in other answers, that Linux platform does not have much viruses. Source code of almost all the components of Linux is freely available.

Say, a team of 5 members develop an application. We include testers and few others in the list and at most 10 person will know the code. Out of these ten, chances are some will have not enough detailed knowledge of the code. Hence the number of people who know code good enough to point out bugs, security holes is very less.

Now if this code is made free/open source, the pair of eyes that will review it increases drastically. Hence the probability of finding security holes also increases.

These new contributors bring their experience with them, and often fresh eyes are able to notice loopholes that originally developers ignored/took for granted/missed.

The more popular the application is, the more contributors it has. I think this freedom/openness contributes to less number of vulnerabilities of Linux platform.

  • 5
    I really hate to say this, but the open or closed source nature may only affect the speed at which a particular bug-state is reached. See: "Milk or Wine" by Andy Ozment (andyozment.com/papers/…) and Ross Anderson's "Open and Closed Systems are Equivalent" (cl.cam.ac.uk/~rja14/Papers/toulousebook.pdf)
    – user732
    Oct 14, 2010 at 20:03
  • Thanks Bruce for sharing the links. Will definitely go through them. Oct 15, 2010 at 2:33
  • 4
    Which Linux user reviews all source code before issuing a sudo make install?
    – Calmarius
    Oct 27, 2012 at 16:18

There are already good answers but I'd still like to contribute something.

Including the simple security practices that are still better than windows even after all this time, and all those viruses, I also believe the issues are largely social.

I believe that the main factor is the diversity of distros. This raises the labour involved in making sure that a virus has what it needs to spread. This combined with the demographics of linux users who are not as likely (imho) to click on a dodgy email or generally put themselves at risk means that the success of a virus is further inhibited.

People are also arguably more motivated to attack windows.


While yes, there are a few viruses for Linux, you don't need to worry too much about them. They are uncommon enough to likely miss you entirely.

What you can, and should worry about though, is worms. These programs, unlike viruses that usually take user interaction to infect, spread all by themselves between servers, exploiting vulnerabilities in services and platforms. Worms search for more servers to infect, install themselves on vulnerable machines and frequently modify their behavior - e.g. to serve viruses to visiting Windows clients.


The simple answer is that no operating system is 100% secure, unless it reads itself from read-only medium at startup is 100% secure.

However, Windows has more vectors for infections, those vectors are more readily accessible, and once infected can do much more harm. This can be readily seen by reading the "RootKit Arsenal" or other books.

The number of exploits on any machine is roughly proportional to (ave gain for rooting one machine ) * number of machines/(cost to create rooting malware).

Since the number of exploits is proportional to the number of computers it makes sense that the amount of malware is greater on Windows.

But, it is stupid to assume the only reason. Windows has more viruses is because there are more computers running it. Note that in Linux getting infected with malware is much less costly then in Windows because the damage is more contained. Conversly the amount gained by one rooting is smaller). Note also that the cost of rooting is higher because of the reasons I mention in the first paragraph.

Keep in mind this is true as of now. At this point linux is a better architected system then Windows. There are however forces saying that we need more rapid development of user friendly features. This can lead to making it easier for bugs to exist and viruses to be created. Already I find Ubuntu to be almost as buggy as Windows.

  • The read only boot media only reduces the attack surface it does not prevent malware.
    – symcbean
    Aug 1, 2016 at 22:47
  • re: Windows has more ... computers running it. Well, more end-user computers running it. I believe there are more head-less servers running some flavor of *Nix (Unix-variant, Linux-variant) than there are Windows. The early days of DOS and Windows having zero-security was a big factor in that platform being targeted. Apr 27, 2018 at 23:33

Other answers have provided good historical references for viruses on Unix and Linux. More contemporary examples include the "Windigo" and "Mayhem" malware campaigns. These have infected many thousands of systems. Mayhem has been reported to be using the Shellshock vulnerability to spread.

As for Linux malware detection software, you have both open source and commercial alternatives. The most effective, in my biased opinion, is Second Look. It uses memory forensics and integrity verification to detect Linux malware. I am a developer of Second Look.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .