Is there a simple way to check whether or not my Ubuntu machine is part of a botnet?

  • Put a sniffer on your network cable and watch if there is any in-/outgoing traffic without doing anything (and having internet browsers, mail, chat and torrent clients, ... closed) – Lekensteyn Oct 21 '11 at 19:29
  • 1
    Or just netstat -a with other things closed (including ubuntu-one as well) – belacqua Oct 21 '11 at 20:23
  • 1
    @Lekensteyn - the last time I sniffed my traffic (which I do regularly for debugging software I write), there was a mindboggling amount of things going on across a bunch of protocols. Depending on what network I'm on, there's even more. I, for one, have no idea what kinds of software do all that, and whether they are legitimate. Is there a list? – Hanno Fietz Jan 4 '13 at 11:10
  • @HannoFietz With the sniffer approach you will get a lot spam from broadcast traffic, with a wireless network you will see even more control messages. Assuming that a infected machine will regularly "call home", it should be sufficient to set a filter to capture outgoing traffic only. netstat was mentioned, ss may also be useful to you. – Lekensteyn Jan 4 '13 at 15:07

Install clam-tk and clam-av. This is a virus scanner and a GUI frontend, this will scan your Ubuntu machine for viruses, malware, and the like. Also helpful is the ability to scan windows partitions, helpful for dual-booters.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.