Help! I think I have a virus on my Debian Server..

sspiro · 03-09-2005, 08:25 PM

Still fairly new to linux, have been running a debian server for about 3 or 4 months to host some personal websites for myself and a family member or two.

I recently reformated my main PC (WinXP Pro) and obtained a virus shortly thereafter (few days ago) when I downloaded a questionable item (won't go into details)..This virus wrecked havoc on my main PC.. actually; it's been a nitemare. I never even thought it would infect my debian machine, and maybe it hasn't. Here are the details:

Upon checking free I see that I have 2% RAM left. Also I can't apt-get update, and I tried to install clamav, but I can't get that either..

SSH works...apache works..mysql works.. I can connect to the site through any of these services but the resources are blown out.

I don't have any active backups on this system (ARGHHhhhh) which is my fault.. But what are my options? Any thoughts on what is wrong with system? IS it in fact a virus or is it something else?

comprookie2000 · 03-09-2005, 08:51 PM

Anything interesting when you do a;

Code:

$ grep -i "failed password" /var/log/messages

sspiro · 03-10-2005, 06:50 AM

Absolutely nothing..

Quote:

spirowebserver:/# $ grep -i "failed password" /var/log/messages
bash: $: command not found
spirowebserver:/# grep -i "failed password" /var/log/messages
spirowebserver:/#

Update: I have been able to install clamav but it won't scan. I also have been able to get apt-get update to work also (not sure how, but it works now)...

Paxmaster · 03-10-2005, 11:27 AM

in the linux world the memory works very differnt way then in wndow world , just don't worry about

sspiro · 03-10-2005, 05:30 PM

Not worry about it? I can't even connect to the webserver when its running on 2% RAM left!

Needless I finally got ClamAV to scan and it detected and cleaned 4 viruses..Rebooted and I'm back down to about 35% RAM used.

Capt_Caveman · 03-10-2005, 07:26 PM

It's probably a good idea to download and run rootkit hunter on the system to identify any other hidden surprises on the system (rootkits, bindshells, etc).

sspiro · 03-10-2005, 08:52 PM

Quote:

Originally posted by Capt_Caveman
It's probably a good idea to download and run rootkit hunter on the system to identify any other hidden surprises on the system (rootkits, bindshells, etc).

Great suggestion. I was unfamiliar with that program until now..

Quote:

MD5
MD5 compared: 67
Incorrect MD5 checksums: 0

File scan
Scanned files: 342
Possible infected files: 0

Application scan
Vulnerable applications: 3

Scanning took 143 seconds

Even showed me some services I need to tighten up...

Thank you sir.

Capt_Caveman · 03-10-2005, 09:18 PM

Quote:

Originally posted by sspiro
Great suggestion. I was unfamiliar with that program until now..

No problem. I'd also suggest looking into a file integrity scanner like tripwire, aide or samhain. They're really meant to be put on a system immediately after installation, so in this case they wouldn't be much help. But when used properly, they allow you to immediately detect modification of any critical system files and configs. In a situation like investigating a potential compromise or viral infection they can save you alot of time and grief.
Cheers.

floppywhopper · 03-11-2005, 06:02 PM

Just to clarify something .... please

Your Debian server had 4 viruses on it ???
or were you referring to your windows system

floppy

tokyoeye · 03-11-2005, 07:02 PM

Could you maybe do a top to see what's eating all your RAM? When you're in top use M to see the memory usage. This could shed some light on what's causing the problem. If you see any processes you don't trust you can investigate the problem or give them a kill -9.

apsivam · 03-14-2005, 04:27 AM

Quote:

Originally posted by floppywhopper
Just to clarify something .... please

Your Debian server had 4 viruses on it ???
or were you referring to your windows system

floppy

Nope those viruses reported by ClamAV were the virus test files that comes with ClamAV itself. More over ClamAV is a Virus Scanner ONLY not a remover.