What precautions should one take in prevention of attack by trojan BackDoor.Wirenet.1?

Blocking all communications with should be sufficient? If so, how to do it?

  • 1
    by not launching any program you don't know/trust?
    – steabert
    Aug 29 '12 at 20:10
  • 6
    No immediate steps are necessary, other then learning about Linux Security. Aug 29 '12 at 20:28

My understanding is the wirenet-1 has to create a file in the directory ~/ WIFIADAPT Since Linux sees directories and files as the same (you can't have a file and directory by the same name) I believe that creating an empty file by the name of WIFIADAPT in your home directory would keep your from getting the Trogen since It would not be able to create the Directory WIFIADAPT the location it stores the infection. Just for extra measures I would set the permissions on the created file read only. This is just my suggestion but I believe this would work. It also wold be a good idea to block the above mentioned IP address.

  • by logic yeah! i agree
    – penreturns
    Sep 1 '12 at 19:44
  • This is an interesting approach. Sep 4 '12 at 20:45

BackDoor.Wirenet.1 Keylogger is a backdoor trojan that can run on Linux and MacOSX, stealing personal information, passwords, and banking credentials! It copies itself to the user's home directory at /home/WIFIADAPT

It then creates a connection to a remote IP, currently

Defence and Removal:

  1. Block that IP with your router / firewall.
  2. Delete the above directory/files.
  • Thanks for the advice. Is there someway to know the source of infection?
    – user86499
    Aug 30 '12 at 12:16
  • How would we go about blocking that particular IP address? UFW can only block ports, right? Aug 30 '12 at 15:54
  • hum, and how did it get the rights to write in /home/WIFIADAPT ? It asked politely the user ? Or did you make a mistake and this is ~/WIFIADAPT that is targeted ?
    – vaab
    Sep 3 '12 at 17:29
  • 2
    @Glutanimate Looks like this does the job: sudo ufw reject out to You can test by trying to ping to that IP later.
    – jcollado
    Sep 5 '12 at 3:31
  • 1
    @Glutanimate sudo -- iptables -Block INPUT -s -p all -j DROP will also do it, but will only persist until you logout unless you add it to one of your startup scripts.
    – Joe
    Sep 5 '12 at 20:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.