When I run rkhunter, it outputs this log with warnings (too long to post here): http://pastebin.com/hW6C5LGU

And when I run chkrootkit it outputs this with a warning about Operation Windigo/Ebury: http://pastebin.com/ZqTBfGyJ

It says "Searching for Linux/Ebury - Operation Windigo ssh... Possible Linux/Ebury - Operation Windigo installed"

Is this something I should be worried about? If so, what does it do and how do I remove it, should I do a full reinstall?


This sounds normal to me. Looking at this question, it appears the cause of the error message you're seeing is the lack of an illegal operation string in the output of ssh -G. However, the same is true on my system, which I'm 99.9% sure is currently clean.

As to the warning output in rkhunter, have a look at this ServerFault question - that also sounds normal.

However, if you do conclude that your machine is infected, the safest way to remove any malware is to wipe and reinstall the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.