3

When I run rkhunter, it outputs this log with warnings (too long to post here): http://pastebin.com/hW6C5LGU

And when I run chkrootkit it outputs this with a warning about Operation Windigo/Ebury: http://pastebin.com/ZqTBfGyJ

It says "Searching for Linux/Ebury - Operation Windigo ssh... Possible Linux/Ebury - Operation Windigo installed"

Is this something I should be worried about? If so, what does it do and how do I remove it, should I do a full reinstall?

Improve this question

1 Answer 1

Reset to default
4

This sounds normal to me. Looking at this question, it appears the cause of the error message you're seeing is the lack of an illegal operation string in the output of ssh -G. However, the same is true on my system, which I'm 99.9% sure is currently clean.

As to the warning output in rkhunter, have a look at this ServerFault question - that also sounds normal.

However, if you do conclude that your machine is infected, the safest way to remove any malware is to wipe and reinstall the system.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .