I recently ran sudo chkrootkit
and this was one of the results:
Searching for Linux/Ebury - Operation Windigo ssh... Possible Linux/Ebury - Operation Windigo installetd
In my research on this I discovered this thread, so I tried running the commands recommended there, the first two commands:
netstat -nap | grep "@/proc/udevd"
find /lib* -type f -name libns2.so
Outputted nothing. However this command:
ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
Outputted:
System infected
So am I infected or not? I read about this (though I found a more descriptive report before but can't find it again), so could this be it? I have done a fresh install and it is still being detected. So is there any way of further checking and should I be worried?
OS Information:
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 15.10
Release: 15.10
Codename: wily
Flavour: GNOME
GNOME Version: 3.18
Package Information:
chkrootkit:
Installed: 0.50-3.1ubuntu1
Candidate: 0.50-3.1ubuntu1
Version table:
*** 0.50-3.1ubuntu1 0
500 http://archive.ubuntu.com/ubuntu/ wily/universe amd64 Packages
100 /var/lib/dpkg/status