4

Is there a simple way to check whether or not my Ubuntu machine is part of a botnet?

4
  • Put a sniffer on your network cable and watch if there is any in-/outgoing traffic without doing anything (and having internet browsers, mail, chat and torrent clients, ... closed)
    – Lekensteyn
    Oct 21, 2011 at 19:29
  • 1
    Or just netstat -a with other things closed (including ubuntu-one as well)
    – belacqua
    Oct 21, 2011 at 20:23
  • 1
    @Lekensteyn - the last time I sniffed my traffic (which I do regularly for debugging software I write), there was a mindboggling amount of things going on across a bunch of protocols. Depending on what network I'm on, there's even more. I, for one, have no idea what kinds of software do all that, and whether they are legitimate. Is there a list? Jan 4, 2013 at 11:10
  • @HannoFietz With the sniffer approach you will get a lot spam from broadcast traffic, with a wireless network you will see even more control messages. Assuming that a infected machine will regularly "call home", it should be sufficient to set a filter to capture outgoing traffic only. netstat was mentioned, ss may also be useful to you.
    – Lekensteyn
    Jan 4, 2013 at 15:07

1 Answer 1

3

Install clam-tk and clam-av. This is a virus scanner and a GUI frontend, this will scan your Ubuntu machine for viruses, malware, and the like. Also helpful is the ability to scan windows partitions, helpful for dual-booters.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .