0

I have a CENTOS server that is infected with malware: top shows there's an unknown process that's consuming all the CPUs, if you kill it, it respawns with a different name.
what's the best way to clean up this malware and find the root cause? would installation of an antivirus software help in this situation? if so, which?

Improve this question
2
  • What's the name of the process?
    – Itai Ganot
    Commented Jan 24, 2015 at 7:08
  • Try to kill the parent process first. Or: Try the stop-signal instead of the kill-signal.
    – Nils
    Commented Jan 24, 2015 at 22:20

1 Answer 1

Reset to default
2

When you've been rooted (and it sounds like you have been), the recommended practice is to reinstall the OS and to carefully restore your data from backups. If it's an important system, I'd disconnect it from the network straight away.

If the server isn't that important, it can be educational to spend time attempting to track down the root cause so that you can take steps to prevent it from happening again. However, you need to be very familiar with the OS and Unix tools to do this.

You could spend a long time trying to sanitise your system but without carrying out a fresh install of a new OS, you can never be 100% sure that all malicious binaries and/or scripts have been removed.

Anti-virus software is available for Linux from vendors such as McAfee but I've never known anyone to use it -- presumably, it's used in situations where a corporate policy requires the use of anti-virus software.

Edit: In the future, I'd install rkhunter (Rootkit Hunter), a tool that scans for rootkits, backdoors and various other exploits. It should be installed on a clean system with a nightly cron job to scan system binaries for differences-- and warn if any were found. With a CentOS system, it can also be configured to use RPM's inbuilt verification and I consider it a useful complement to running rpm -Va to verify all files installed by the RPM package manager.

Improve this answer
4
  • 1
    I'll confirm the last paragraph: Linux anti-virus only runs where corporate policy is rigid and stupid enough to require it. At least early revs of what became the PCI DSS had level 1 merchants running anti-virus on all servers, no exceptions, so such policies do exist.
    – user732
    Commented Jan 23, 2015 at 23:59
  • 1
    @BruceEdiger and to add to that - I never found a linux antivirus product capable of scanning/protecting boot sectors.
    – Nils
    Commented Jan 24, 2015 at 22:22
  • @BruceEdiger and Nils Thanks for the extra info. I've never tried or even investigated any of the anti-virus products and didn't know they were required for PCI compliance.
    – Anthony Geoghegan
    Commented Jan 25, 2015 at 18:17
  • 1
    They may not be required for PCI DSS compliance now - I saw them in a preliminary version in 2006. I haven't had a reason to read something that boring in a while.
    – user732
    Commented Jan 25, 2015 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .