Yesterday, I went on a dark creepy site whose js freezed my
system/firefox (Ubuntu 14.04 up to date, Firefox 37.0.1 up to date). Now I tried, from the same system, to find any malware with:
sudo rkhunter --check
showing nothing but the default false-positives.
I know it is recommended to do this from a liveCD or liveUSB making it hard for the malware to hide. I have a liveUSB SystemRescueCD but I am not aware of how to accomplish this. I pretty sure I will need to mount the "infected-device" to check it but every tutorial I found just mentioned
to do the commands which I have posted above from a LiveUSB. Not how, and I am pretty sure
rkhunter can not check a file system without having it mounted.
However now I am at my maybe infected system with the LiveUSB plugged in but not mounted. (I disabled automount due several reasons)
Could it be that my LiveUSB is now also infected even when it is not mounted? I know the malware could write to the device even without mounting it but this would totally destroy the filesystem on the USB. Where can I look up a mount-history in case the malware did it unbeknown of me? I know, for that he would need my user password but who says that the malware did not log my keyboard when executing an sudo command?