I recently ran
sudo chkrootkit and this was one of the results:
Searching for Linux/Ebury - Operation Windigo ssh... Possible Linux/Ebury - Operation Windigo installetd
In my research on this I discovered this thread, so I tried running the commands recommended there, the first two commands:
netstat -nap | grep "@/proc/udevd" find /lib* -type f -name libns2.so
Outputted nothing. However this command:
ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
So am I infected or not? I read about this (though I found a more descriptive report before but can't find it again), so could this be it? I have done a fresh install and it is still being detected. So is there any way of further checking and should I be worried?
No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 15.10 Release: 15.10 Codename: wily Flavour: GNOME GNOME Version: 3.18
chkrootkit: Installed: 0.50-3.1ubuntu1 Candidate: 0.50-3.1ubuntu1 Version table: *** 0.50-3.1ubuntu1 0 500 http://archive.ubuntu.com/ubuntu/ wily/universe amd64 Packages 100 /var/lib/dpkg/status