0

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script.

The script ran without asking for a password so I thought that nothing suspicious was going on. Later I saw that the installation script had written on files that a normal user didn't have write permissions on. So I am guessing my fail was that probably I have run another command which required elevated privileges earlier in the session and the shell had my root password in memory.

So my questions are,

  1. What are the odds that there was actually a malware there? (I know this is subjective so it doesn't matter much)
  2. What steps can I follow to check if I have been infiltrated?
  3. In order to recover from the attack I should probably do a reinstall of the OS. What should I do with the files in the home directory? As far as I understand it is possible that the virus has copied itself on them. Can I somehow check and remove it if present?

I run an ArchLinux with regular updates if this means anything.

  • 1
    As an aside, it's good practice to revoke your sudo credentials using sudo -K before running any suspicious script (well, insofar as running any suspicious script is good practice in the first place). – Chris Feb 8 '16 at 11:34
1

My advice,

  1. Rebuild the machine
  2. Restore the contents of the home directory from the backup nearest to the point before you ran the script.

If you don't, the next time anything weird happens, you'll be left wondering if you've still got an infection.

There are virus / malware scanners for Linux, so you could check those out (I don't have any I can specifically recommend), but even if they report your machine is clean - how much are you going to trust them?

  • What can i do about some files that are not present in the backup? Is there a way to check them? – slagathr Feb 8 '16 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.