0

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script.

The script ran without asking for a password so I thought that nothing suspicious was going on. Later I saw that the installation script had written on files that a normal user didn't have write permissions on. So I am guessing my fail was that probably I have run another command which required elevated privileges earlier in the session and the shell had my root password in memory.

So my questions are,

  1. What are the odds that there was actually a malware there? (I know this is subjective so it doesn't matter much)
  2. What steps can I follow to check if I have been infiltrated?
  3. In order to recover from the attack I should probably do a reinstall of the OS. What should I do with the files in the home directory? As far as I understand it is possible that the virus has copied itself on them. Can I somehow check and remove it if present?

I run an ArchLinux with regular updates if this means anything.

Improve this question
1
  • 1
    As an aside, it's good practice to revoke your sudo credentials using sudo -K before running any suspicious script (well, insofar as running any suspicious script is good practice in the first place).
    – Chris
    Feb 8, 2016 at 11:34

1 Answer 1

Reset to default
1

My advice,

  1. Rebuild the machine
  2. Restore the contents of the home directory from the backup nearest to the point before you ran the script.

If you don't, the next time anything weird happens, you'll be left wondering if you've still got an infection.

There are virus / malware scanners for Linux, so you could check those out (I don't have any I can specifically recommend), but even if they report your machine is clean - how much are you going to trust them?

Improve this answer
1
  • What can i do about some files that are not present in the backup? Is there a way to check them?
    – slagathr
    Feb 8, 2016 at 11:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .