I think I've got malware on my laptop. You see, I got suspicious disc activity after accessing a dodgey website.

So I'm going to run rkhunter on the laptop from a live knoppix USB stick.

My linux system is on partition /dev/sda6. Presumably I need to actually MOUNT sda6 in order to run rkhunter on it (or am I wrong). But if I mount it, does this allow the malware to become active and do nasty things?

I'm only just starting to learn about malware scanners, and was proposing to run the following on the laptop: rkhunter, chkrootkit, and clamtk or clamav. Will running all 3 programs be sufficient in searching for malware?

I acquired the malware while running linux on sda6, but do I need to check for this malware on the other partitions too (sda1, sda2, and sda3 are for Windows, and sda5 is linux swap)?

Is rkhunter better than chkrootkit or vice versa?


As a general rule, you're usually safe mounting partitions that are suspected to be infected, as long as your system isn't set to automatically run anything from them (and assuming the malware isn't using a bug in the filesystem drivers, but that's usually a safe assumption).

As far as how sufficient scanning is, if you are fairly certain that the malware is present, you're probably better off pulling your data off of the device, and reinstalling from scratch. Scanning is not 100% reliable, and it can only reliably detect things the scanner knows about. For generic scanning, I usually find ClamAV to be reliable for offline scanning of Windows systems, and I assume it will do fine on Linux, but I've never used it on a Linux system. rkhunter and chkrootkit are really designed for checking running systems, not offline (all of their heuristic checks only look at the live system, so they can only check for known malware).

As far as other operating systems, you should check those too, especially if you find anything. For the swap space, just wipe it (blkdiscard /dev/sda5 if it's on an SSD, dd if=/dev/zero of=/dev/sda5 if it's a hard drive) and recreate the swap header. For the Windows side, if you have WIndows boot it and tell Windows Defender or whatever other AV software you use to run a full scan (that will check all the partitions).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.