[clamav-users] Can ClamAV detect LKM rootkits?
zhuangxiaohui at ffcs.cn
Mon Dec 3 22:32:35 EST 2018
I've tested two types of rootkits with ClamAV.
Adore-ng(kernel level) & Mafix(application level)
Well, virus implanted by Mafix were completedly detected :
/usr/bin/md5sum: Unix.Malware.Agent-6005569-0 FOUND
/usr/bin/find: Win.Trojan.U-110 FOUND
/usr/bin/pstree: Win.Trojan.Rootkit-5 FOUND
/usr/bin/dir: Unix.Malware.Agent-1393952 FOUND
/bin/ls: Unix.Malware.Agent-1393952 FOUND
/sbin/ifconfig: Unix.Malware.Agent-1696070 FOUND
/sbin/ttyload: Heuristics.Broken.Executable FOUND
/sbin/ttymon: Win.Trojan.Linux-29 FOUND
But when I tested with Adore-ng, nothing was detected.
And then I tested it with ESET(one of anti-virus soft) and was detected.
The virus name detected by ESET was "a variant of Linux/Rootkit.Adore.B
So I wonder can ClamAV detect LKM rootkits?
Or would you mind to tell me where can I find the virus list that ClamAV can
More information about the clamav-users