It seems that my computer has been infected with trojans. How to fix it? Thx.
Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
It seems that my computer has been infected with trojans. How to fix it? Thx.
I'm now running Ubuntu 9.04. There are 2 accounts on this computer, one is linux, the other is ubuntu.
Before New year, everything had been fine. But after new year, I came back and found that the password of this account linux has been changed. So I fixed using my rescue disk. But since that day on, it seems that this password changes everyday somehow. Everyday when I'm trying to log into my Ubuntu System using the account linux, it says login failed. However, i can still login using the account ubuntu.
I'm really confused. Why is this? I checked the date of expiry. Everything seems to be fine.
Do you have any good ideas? Thanks for your suggestion!
Last edited by whepin; 01-07-2010 at 02:48 PM.
Reason: The new title is more suitable for my thread after it was moved to the security forum. Thx.
Do you have a firewall? Do you have ports open to the internet? Are you sure you haven't been rooted? It sounds like someone has gained control of your machine; either through the internet or perhaps after hours, if this is a work or school machine.
Thanks for you reply. I haven't installed firewall on my Ubuntu. It is only used in my lab for our robot project. I think myabe our university should have some kind of firewalls to protect all internal computers. But I am not 100 precent sure.
Well, someone may have rooted your machine, so run rkhunter and chkrootkit to make sure. But I'm thinking that you have someone actually sitting down at the machine and doing this. Have you tried changing your root password to see if the problem stops? Of course, depending on which distro it is, they might be able to just reboot it and change the password that way. You might check to see when the last time it was rebooted to get some idea.
People will do all sorts of evil things when they think no-one can catch them. I once had someone (probably the night guard) using my portable radio. I finally locked in a cabinet but made the mistake of leaving the key in my desk drawer. He simply opened the cabinet with the key and stole the radio. Management wasn't interested in dealing with the theft problem, so people gradually started being more secure at work.
It's so terrible. I found a lot of warnings from these two softwares. It seemed that at least top, ifconfig, netstat and other files had been infected with trojans.
So the problem is how to fix it? This is really important for us.
I'm not qualified to help you, really. But, you can get to the guys who are by clicking the Report button and asking that your thread be moved to the "Linux - Security" forum. Good luck!
Anyway, thank you very much.
I'm now trying to install a firewall and try to block all inbound connections except computers belonging to our LAN. I don't know if this will help a lot. But that is what I can do quickly.
post your check logs, please.
try to reinstall those binaries.
change all passwords, clear .ssh/authorized_keys* files, if you don't use key-based auth on servers(or if you do, check they don't contain other unknown keys).
run lastlog, history to see last logins and last commands. check .bash_history for your and root accounts. these simple steps may help you.
It's so terrible. I found a lot of warnings from these two softwares. It seemed that at least top, ifconfig, netstat and other files had been infected with trojans.
So the problem is how to fix it? This is really important for us.
Thanks.
Those could be false positives. Did it find any rootkits?
Is it saying those files are shell scripts not binaries?
Anyway, thank you very much.
I'm now trying to install a firewall and try to block all inbound connections except computers belonging to our LAN. I don't know if this will help a lot. But that is what I can do quickly.
If you really want help with this, you need to do a few things. Blocking all external inbound connections is just tinkering, you need to block ALL connections with the exception of SSH access from a trusted IP address. If you can completely isolate this box from the network (pull the network plug) that would be better.
Once you've done that you can start gathering evidence. Web3l337 is pointing in the right direction. What is needed are log files and the output from a few commands:
lsof -Pwn
netstat -anpe
ps -axfwwwe
If any of these are too big to post, email them to me and I'll find a place to host them.
Please be aware that there may not be any quick fixes for this. The whole idea here is to do an investigation into what happened so that you can prevent it from happening in the future. Unless you're willing to do that investigation, any action you take will likely be useless.
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `crontab'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not found
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... INFECTED
Checking `inetd'... not infected
Checking `inetdconf'... not infected
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not found
Checking `netstat'... INFECTED
Checking `named'... not found
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... INFECTED
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not infected
Checking `syslogd'... not infected
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... INFECTED
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not found
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... /etc/ld.so.hash
Searching for sniffer's logs, it may take a while... nothing found
Searching for rootkit HiDrootkit's default files... nothing found
Searching for rootkit t0rn's default files... nothing found
Searching for t0rn's v8 defaults... Possible t0rn v8 (or variation) rootkit installed
Searching for rootkit Lion's default files... nothing found
Searching for rootkit RSHA's default files... nothing found
Searching for rootkit RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/firefox-3.0.14/.autoreg /usr/lib/xulrunner-1.9.0.14/.autoreg /lib/init/rw/.ramfs /lib/modules/2.6.28-11-generic/volatile/.mounted
Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... Warning: Possible Showtee Rootkit installed
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... /usr/include/file.h /usr/include/proc.h
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... Possible ShKit rootkit installed
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for rootedoor... nothing found
Searching for ENYELKM rootkit default files... nothing found
Searching for common ssh-scanners default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... chkproc: nothing detected
chkdirs: nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... lo: not promisc and no packet sniffer sockets
eth0: not promisc and no packet sniffer sockets
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... chklastlog: nothing deleted
Last edited by unSpawn; 01-08-2010 at 01:19 PM.
Reason: //Added code tags
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
