I had opened a php folder from a friend's web host. I run it on mine to fix some bugs.

Then I tried attaching the code to be emailed and GMAIL stated that the attachment was infected by a virus.

Now I'm afraid if my Apache or OS (12.04) is infected.

I checked the php files and found a base64 encoded set of code being 'eval'd at the top of each and every php file. Just reversing it (echo with htmlspecialchars) showed some clue that there were sockets in use and something to do with permissions. And also there were two websites referred having .ru extensions.

Now I'm afraid if my Ubuntu system is affected or compromised.

Any advice please!

Here's my second run of rkhunter with the options:

**sudo rkhunter --check --rwo
Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: /usr/bin/unhide.rb: Ruby script, ASCII text**

**Warning: Hidden directory found: /dev/.udev**

**Warning: Hidden file found: /dev/.initramfs: symbolic link to `/run/initramfs'**
  • 2
    Remove the encrypted/encoded code, then run rkhunter or chkrootkit or other rootkit checkers. – Thomas Ward Oct 11 '12 at 14:11
  • Adding to what @LordofTime said, if the infected file changed permissions of all files in your system, try this one. – Evandro Silva Oct 11 '12 at 14:14
  • And if you're truly concerned, nuke the OS and replace the data. And don't trust your "friend"'s code without going through it, in future. And don't just send .php files in gmail, 95% of the time .php files are identified weirdly. – Thomas Ward Oct 11 '12 at 14:15
  • @LordofTime Thanks for the info. I rkhunter and got the following line in the report as a wrarning: Warning: Hidden directory found: /dev/.udev and this: Warning: Hidden file found: /dev/.initramfs: symbolic link to `/run/initramfs'. Is this something to be concerned about? – itsols Oct 11 '12 at 14:51
  • @LordofTime Really appreciate your rkhunter idea. It seems to be the fastest way so far. But still I'm worried :/ – itsols Oct 11 '12 at 14:56

The key problem you have is this:

You don't know just how much is compromised! Without skilled forensic analysis can you tell whether the attacker has just inserted some code which attaches to outgoing documents, has a rootkit which is snarfing your personal details, logons etc, or is using your machine as part of a botnet (or all of the above)

Treat it as fatally compromised, wipe the drives entirely and reinstall from known clean install media and backups!

| improve this answer | |
  • +1 for your advice but this is my development machine and it's a terrible experience to reinstall the software at this point. So if I can first fix it without a reformat, that would be the best option. – itsols Oct 11 '12 at 14:55
  • 3
    Do you want to develop, not knowing whether the code you write is compromised? Not knowing whether an attacker somewhere is storing credentials for your code, or even stealing your code for reuse etc? Of course, you may rate that as a low risk, but you should be aware that it is quite likely. Usually a reinstall is best. This time, it may be high effort, but in future, keep backups that allow you to rapidly be up and running with your build. Also have a look at security.stackexchange.com/questions/993/hardening-linux-server for some guidance (not Ubuntu specific, but good nonetheless) – Rory Alsop Oct 11 '12 at 15:09
  • @roryaslop Thanks for your inputs. I agree with you... I maybe ignorant of this aspect regarding ubuntu but I'd like to know if it still requires a fresh install even after rkhunter gives no serious errors? Please see my post for the update - I've shown the errors in summary. – itsols Oct 11 '12 at 15:16
  • Better safe than sorry... I'll take your advice and here goes another week past deadlines :( – itsols Oct 11 '12 at 16:43
  • @itsols the suggestion that Rory makes in this answer is really the ultimate way (in terms of assurance) to solve this if you want to be absolutely sure your system is clean. – Thomas Ward Oct 12 '12 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.