1

I have Ubuntu 14.10. How do I check if my Ubuntu is part of a botnet? These are the addresses I found with netstat:

tcp   ESTAB      0      0           192.168.5.122:33195     213.199.179.157:40016  
tcp   ESTAB      0      0           192.168.5.122:52340     64.4.47.18:https   
tcp   ESTAB      0      0           192.168.5.122:51396     157.56.53.41:12350   
tcp   ESTAB      0      0           192.168.5.122:38527     157.56.194.8:https   
tcp   ESTAB      0      0    ::ffff:192.168.5.122:54152     ::ffff:74.125.71.125:xmpp-client 
tcp   ESTAB      0      0    ::ffff:192.168.5.122:33257     ::ffff:173.252.106.17:xmpp-client 
tcp   ESTAB      0      0    ::ffff:192.168.5.122:36003     ::ffff:64.233.167.125:xmpp-client

This is what netstat -tlnp has shown:

(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address    Foreign Address   State       PID/Program name
tcp        0      0 0.0.0.0:15668    0.0.0.0:*         LISTEN      11551/skype     
tcp        0      0 127.0.1.1:53     0.0.0.0:*         LISTEN      -               
tcp        0      0 0.0.0.0:25       0.0.0.0:*         LISTEN      -               
tcp        0      0 127.0.0.1:2628   0.0.0.0:*         LISTEN      -               
tcp6       0      0 ::1:13113        :::*              LISTEN      11552/java      
tcp6       0      0 :::25            :::*              LISTEN      -  
  • Purely based on a few TCP connections it's hard to tell you are actucally infected with malware. We'll need a lot more details to be able to be conclusive on this. I don't think this site is a good place to have your system checked. If you really want to though, please provide all information in your question, like what processes (+ binaries) are performing these connection, create PCAPs and provide them for analysis, etc. Remember that we can't access your machine and can't see your screen. We rely completely on the information in your question. – gertvdijk Mar 24 '15 at 11:24
  • Use netstat -tnlp, check the PIDs and the programs which are behind those processes. – muru Mar 24 '15 at 11:30
  • I edited it...but so far everything seems legit so I'm ok. – Mario Kamenjak Mar 24 '15 at 12:32
2

You need to track down each program that is running on those ports. Are you running xmpp yourself? Are you running a webbrowser? Specifically what is connecting to port 40016 and 12350?

lsof -i TCP:40016
lsof -i TCP:12350
lsof -i TCP:xmpp-client

you might need to sudo those.

| improve this answer | |
  • Those ports were skype and a chat client.It's alright,everything seems legit so far. – Mario Kamenjak Mar 24 '15 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.