up vote 10 down vote favorite
2

What precautions should one take in prevention of attack by trojan BackDoor.Wirenet.1?

Blocking all communications with 212.7.208.65 should be sufficient? If so, how to do it?

share|improve this question
1  
by not launching any program you don't know/trust? – steabert Aug 29 '12 at 20:10
6  
No immediate steps are necessary, other then learning about Linux Security. – mikewhatever Aug 29 '12 at 20:28
up vote 8 down vote accepted

BackDoor.Wirenet.1 Keylogger is a backdoor trojan that can run on Linux and MacOSX, stealing personal information, passwords, and banking credentials! It copies itself to the user's home directory at /home/WIFIADAPT

It then creates a connection to a remote IP, currently 212.7.208.65

Defence and Removal:

  1. Block that IP with your router / firewall.
  2. Delete the above directory/files.
share|improve this answer
    
Thanks for the advice. Is there someway to know the source of infection? – user86499 Aug 30 '12 at 12:16
    
How would we go about blocking that particular IP address? UFW can only block ports, right? – Glutanimate Aug 30 '12 at 15:54
    
hum, and how did it get the rights to write in /home/WIFIADAPT ? It asked politely the user ? Or did you make a mistake and this is ~/WIFIADAPT that is targeted ? – vaab Sep 3 '12 at 17:29
2  
@Glutanimate Looks like this does the job: sudo ufw reject out to 212.7.208.65. You can test by trying to ping to that IP later. – jcollado Sep 5 '12 at 3:31
1  
@Glutanimate sudo -- iptables -Block INPUT -s 212.7.208.65 -p all -j DROP will also do it, but will only persist until you logout unless you add it to one of your startup scripts. – Joe Sep 5 '12 at 20:56
up vote 9 down vote

My understanding is the wirenet-1 has to create a file in the directory ~/ WIFIADAPT Since Linux sees directories and files as the same (you can't have a file and directory by the same name) I believe that creating an empty file by the name of WIFIADAPT in your home directory would keep your from getting the Trogen since It would not be able to create the Directory WIFIADAPT the location it stores the infection. Just for extra measures I would set the permissions on the created file read only. This is just my suggestion but I believe this would work. It also wold be a good idea to block the above mentioned IP address.

share|improve this answer
    
by logic yeah! i agree – penreturns Sep 1 '12 at 19:44
    
This is an interesting approach. – Exeleration-G Sep 4 '12 at 20:45

protected by Community♦ Sep 14 '12 at 12:07

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.