I have been informed by our university IT that my laptop running ubuntu 16.04 has been infected with a virus/trojan, specifically: https://security.web.cern.ch/security/advisories/busywinman/BusyWinman.shtml
Apparently, my machine is making connections to IP addresses known to be contacted in case of infection. I would like to recover files from the infected hard drive in a save way before formatting the drive.
Unfortunately, our departmental IT person / network admin just quit her job, so I currently have no guidance from our internal resources available.
The linux community largely seems to see linux viruses as a non-issue -- as I did until a few days ago -- so there are no good write-ups that I could find online.
I would hence appreciate some guidance.
My plan so far is to
1) Run ubuntu from a live-usb.
2) Disable auto-mounting using the dconf-editor.
3) Mount the hard drive in read-only mode.
4) Detect infected files using clamAV and remove them.
5) Copy all other documents to a fresh hard drive.
As I have never found myself in this situation, I would appreciate any suggestions on how to improve this plan.
Also, I would like to check if there any relevant virus definititions in the clamAV data base before step 4. Is this possible/feasible, and if so how can I do it?