-2

when I installed the updates on my computer (Ubuntu 14.04), I typed the password, thinking that it was asked for regular updating , but when I noticed some strange behavior and crash at this moment, I suspected the malicious activity. I checked if there were some modified files

find /sbin -mtime -1

and it showed me :

/sbin

/sbin/ldconfig.real

/sbin/ldconfig

I checked then for rootkits with :

chkrootkit | grep INFECTED

and it showed nothing

Nevertheless I worry about ldconfig ldconfig.real files, and so I'm looking for the methods to update them in such a way that last changes (possible malicious activity) will be deleted . when I try to reinstall ldconfig , I have this error while removing with apt-get

E: Unable to locate package ldconfig

closed as off-topic by Rui F Ribeiro, Wouter Verhelst, Jakuje, Anthon, cuonglm Feb 17 '16 at 16:14

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Rui F Ribeiro, Wouter Verhelst, Jakuje, Anthon, cuonglm
If this question can be reworded to fit the rules in the help center, please edit the question.

  • It does not seem malicious, some updates ask for passwords and those files do exist. – Rui F Ribeiro Feb 17 '16 at 10:02
  • @RuiFRibeiro yes but there were some warnings after I typed a password and Ubuntu crash just right after it, so it gave me idea about malicious activity – Andrew_457 Feb 17 '16 at 10:05
  • Hard to tell without reading the warnings. Do you usually have random lock ups? Temperature? Disk errors? – Rui F Ribeiro Feb 17 '16 at 10:16
  • @RuiFRibeiro, No I don't ! it's the first time the crash like this occurred with me, so that's why I'm trying to figure out what happened and how I can fix it – Andrew_457 Feb 17 '16 at 10:20
  • Could be anything, try to read /var/log/messages and /var/log/syslog for clues. hint: with a crash, they may be corrupted, do no panic if they a couple of lines with random garbage. – Rui F Ribeiro Feb 17 '16 at 10:21
3

Both files come from libc-bin

$ dpkg -S /sbin/ldconfig{,.real}
libc-bin: /sbin/ldconfig
libc-bin: /sbin/ldconfig.real

So you could reinstall with:

sudo apt install --reinstall libc-bin

But if something that fundamental as libc is really infected, you're not going to be able to remove it from a live system. It could trivially monkey-patch anything linking to it to just reinfect your computer. You could probably chroot-mount it from a LiveCD and reinstall everything... Or just reinstall from scratch and copy your (checked and sanitised) data over.

But are you really infected in the first place? I don't know why you think you are. There have been libc patches recently (they are usually fairly frequent IME) so I'm not sure what you're seeing is anything but standard stuff.


I really think you're unnecessarily bridging what is more likely to be a bad update, random bug, a service that reloaded onto a new version of libc, etc into a disaster scenario. Especially when we're talking about "some warnings" without knowing what they were. Warnings happen all the time.

You only have a few options:

  • Audit the files from a safe environment (ie a Live CD/USB). If yours claim to be the same version as the originals but their md5sum (or sha256sum, however paranoid you want to be) differ, you have a problem.
  • Assume disaster and reinstall.
  • Take the blue pill, the story ends, you wake up in your bed and believe whatever you want to believe. Ignorance is bliss, right?
  • thanks @Oli, so as I said, there were some warnings after I typed a password and Ubuntu's crash just right after it, so it gave me idea about malicious activity. and when I verified I've seen these two files modified. I don't know how to make sure that there is no real danger, I used two methods find and chkrootkit and the first one gave ldconfig files as a result, so I worked around it now – Andrew_457 Feb 17 '16 at 10:18
  • Your find command is just telling you that files have changed. This isn't strange. This is what package upgrades do. – Oli Feb 17 '16 at 10:37
  • thanks a lot @Oli! the last option is the best one, but the first one is more suitable for someone paranoid like me! ;) – Andrew_457 Feb 17 '16 at 12:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.