Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I recently (re)stumbled upon this: Linux Trojan Goes Unnoticed For Almost A Year (Unreal IRCd)

Yes, I know that adding some random PPA/software from an untrusted source is asking for trouble (or worse). I never do that, but many do (many Linux blogs and tabloids promote adding PPAs for fancy apps, without warning that it may break your system or worse still, compromise your security.)

How can a trojan horse or a rogue application/script be detected and removed?

share|improve this question
    
exact duplicate: unix.stackexchange.com/questions/4060/… –  msw Nov 14 '10 at 21:18
    
I posted that (3 minutes before posting here). I'll remove one of them if this is a violation. –  Sid Nov 14 '10 at 22:24
1  
Most PPA's that are advertised by blogs are signed. It means that only the PPA maintainers/developers can put a package and signed it. If like for the above example someone hack the mirror server and tries to modify a file, your package manager will tell you that you have something wrong with one package. It's up to you then to accept the warning and not install the apps or not. I'm just here to slightly correct your statement :-) your question is still pertinent. –  Huygens Nov 23 '10 at 20:58

5 Answers 5

It's always a game of cat and mouse with detection software. New malware is created, scanners get updated to detect it. There's always a lag between the two. There are programs that use heuristics that watch what software is doing and attempt to catch unwanted activity but in my opinion it's not a perfect solution and uses resources.

My advice is simple, don't install software from sources you don't trust but if you are like me and can't avoid the temptation, put them in a virtual machine (ie virtualbox) and play with it until you're confident it won't either bork your system or do things you didn't want.

Again, not a perfect solution but for now, a virtual machine has the best chance of isolating your machine from unwanteds.

share|improve this answer

Most anti-malware software for Linux/Unix simply searches for Windows malware. The occurences of Linux malware has usually been very limited, even in cases where the security updates are slow or don't come.

Basically, you only use software you trust and update daily, that's how you stay safe.

share|improve this answer

Another response said: "It's always a game of cat and mouse with detection software."
I disagree.

This is true of approaches that rely on signatures or heuristics for detecting malware.
But there is another way to detect malware: verify known goods:

  • Tripwire, AIDE, etc. can verify files on disk.

  • Second Look can verify the running kernel and processes.
    Second Look uses memory forensics to directly inspect the operating system, active services, and applications.
    It compares the code in memory to what has been released by the Linux distribution vendor. In this way it can immediately pinpoint malicious modifications made by rootkits and backdoors, and unauthorized programs (trojans, etc.).

(Disclosure: I am the lead developer of Second Look.)

share|improve this answer
    
Second Look is available in Ubuntu software repository ? –  Boris Jul 24 '12 at 18:53

Kaspersky and avg both have solutions they offer, and McAfee has one for Red Hat that might be available on Ubuntu. avg is here: http://free.avg.com/us-en/download

You might find this article interesting: http://math-www.uni-paderborn.de/~axel/bliss/

I have the mindset that if you have run anything as root that you feel concerned about later, you should probably reinstall. any files you transfer should probably have the executable bit removed as well 'chmod ugo -x'

share|improve this answer

You could also try ClamAV from the software center

share|improve this answer
5  
iirc ClamAV only searches for Windows malware –  Erik Kronberg Nov 15 '10 at 14:21
    
Nope there are a bunch of trojan and a couple of viruses for Linux out there, though they have a hard time surviving and spreading. But anyway, Clamav can detects them (well sometimes it fails, but do you know an anti-virus that can claim 100% virus/trojan detection of all known of them?). It supports ELF32, and 64 (the linux binary formats), as well as many archives, etc. –  Huygens Nov 23 '10 at 21:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.