3

Sometimes I can not enter my website because according to the hosting administrator you tell me that from my IP or from my computer "attacks and port scanning are being launched to various servers protected by the Bitninja network."

How can I do an analysis or scan to my computer in Ubuntu to find out if there are any viruses?

3 Answers 3

3

You could start with the following:

  1. clamav

  2. aide - it's not a malware scanner but an integrity tool, meaning you can check what files were changed since say yesterday.

  3. check open ports:

    sudo netstat -lpntu | less
    

If you have some wide open one, restrict them by IP for instance.

  1. also check the running services to make sure you don't have anything suspicious:

    pstree | less
    
    ps axu | less
    
  2. check cron tasks

1
  • 3
    AIDE: perfect tool. clamav not so.., it will scan linux files with rules that copied from windows. Never going to give a correct result
    – Rinzwind
    Oct 21, 2019 at 18:33
1

Use ClamAV from Ubuntu see the instructions here. https://help.ubuntu.com/community/ClamAV

It is very strange to have any kind of malware on Ubuntu, but if any known viruses have been installed that should find it. However, I suspect that you do not use a static IP address and that the dynamically assigned IP address has been blocked prior to it being assigned to you. You should check and log your WAN IP address whenever you have the issue and when you don't for comparison.

1

Advice above looks good also.
Adding this >> How to determine if mysterious programs in nethogs listing are malware ? Are mysterious programs in nethogs listing malware ?

Confirm nethogs info using netstat to NAME the calling Program

# netstat -tapec

Active Internet connections (servers and established)

Proto, Recv-Q, Send-Q, Local Address, Foreign Address, State, User Inode, PID/Program name

root@-:~ tcp 0 0 192.168.0.55:46092 stackoverflow.com:https ESTABLISHED 2360457 3618/firefox

tcp 0 0 192.168.0.55:60884 ec2-35-160-7-16.u:https ESTABLISHED 35667 3618/firefox

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .