I have been informed by our university IT that my laptop running ubuntu 16.04 has been infected with a virus/trojan, specifically: https://security.web.cern.ch/security/advisories/busywinman/BusyWinman.shtml

Apparently, my machine is making connections to IP addresses known to be contacted in case of infection. I would like to recover files from the infected hard drive in a save way before formatting the drive.

Unfortunately, our departmental IT person / network admin just quit her job, so I currently have no guidance from our internal resources available. The linux community largely seems to see linux viruses as a non-issue -- as I did until a few days ago -- so there are no good write-ups that I could find online.
I would hence appreciate some guidance.

My plan so far is to

1) Run ubuntu from a live-usb.

2) Disable auto-mounting using the dconf-editor.

3) Mount the hard drive in read-only mode.

4) Detect infected files using clamAV and remove them.

5) Copy all other documents to a fresh hard drive.

As I have never found myself in this situation, I would appreciate any suggestions on how to improve this plan.

Also, I would like to check if there any relevant virus definititions in the clamAV data base before step 4. Is this possible/feasible, and if so how can I do it?


Your plan seems sound. Live media don't automount even internal drives, in my experience, so you shouldn't need to change settings for that. You can update ClamAV after installation to ensure it is up to date in terms of definitions.

Unless you can finish the whole job in one session, however, you may find problems with installing ClamAV on the Live media -- the installation won't remain through a reboot. You may want to research "persistence" and "frugal installs" to learn about a method that permits installing software to a USB install in a way that will remain present and configured from session to session.

I'd also recommend transferring only actual documents (pictures, music, word processor files, etc.), not anything that might be executable (which is where any malware would reside). If you take only documents from non-hidden folders in /home, you should avoid passing any infected files to your new install.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.