I think my Linux laptop has been hacked, for three reasons:
Whenever I saved files into the Home folder, the files wouldn't appear - not even in the other folders on my computer.
An unfamiliar .txt file has showed up in my Home folder. Having noticed it, I didn't open it. I immediately had a suspicion that maybe my laptop has been hacked.
When checking my Firewall status, it turned out that it was inactive.
Thus, I have taken the following steps:
I backed-up all of my recent files using two USB Sticks that aren't as important as other USB Sticks which I own - so in case those USB Sticks get infected with the potential malware, it wouldn't infect my other backed-up important files.
I've used ClamTK in order to scan the aforementioned suspicious file - but apparently, for some reason, it hasn't detected any threats.
I've used chkrootkit for another scan. This is the output (up until that point, nothing seemed to have been infected):
Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found: /usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/debug/.build-id /lib/modules/4.13.0-39-generic/vdso/.build-id /lib/modules/4.13.0-37-generic/vdso/.build-id /lib/modules/4.10.0-38-generic/vdso/.build-id /lib/modules/4.13.0-36-generic/vdso/.build-id /lib/modules/4.13.0-32-generic/vdso/.build-id /lib/modules/4.13.0-38-generic/vdso/.build-id /usr/lib/debug/.build-id /lib/modules/4.13.0-39-generic/vdso/.build-id /lib/modules/4.13.0-37-generic/vdso/.build-id /lib/modules/4.10.0-38-generic/vdso/.build-id /lib/modules/4.13.0-36-generic/vdso/.build-id /lib/modules/4.13.0-32-generic/vdso/.build-id /lib/modules/4.13.0-38-generic/vdso/.build-id
Searching for Linux/Ebury - Operation Windigo ssh... Possible Linux/Ebury - Operation Windigo installetd
I was trying - twice - to scan my laptop with F-PROT, with fpscan, using Ultimate Boot CD. But when I tried getting into the PartedMagic section of the disc in order to use the tool, it just wouldn't work. Twice. So I was not able to use it whatsoever.
sudo freshclam, I got the following output:
ERROR: /var/log/clamav/freshclam.log is locked by another process ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
Then, I scanned the computer using rkhunter. These are the warnings I got:
/usr/bin/lwp-request [ Warning ] Performing filesystem checks Checking /dev for suspicious file types [ Warning ] Checking for hidden files and directories [ Warning ]
And this is the summary:
System checks summary ===================== File properties checks... Files checked: 143 Suspect files: 1 Rootkit checks... Rootkits checked : 365 Possible rootkits: 0 Applications checks... All checks skipped The system checks took: 1 minute and 10 seconds All results have been written to the log file: /var/log/rkhunter.log One or more warnings have been found while checking the system. Please check the log file (/var/log/rkhunter.log)
So, after all that - I do not have access to the rkhunter log file as root:
n-even@neven-Lenovo-ideapad-310-14ISK ~ $ sudo su neven-Lenovo-ideapad-310-14ISK n-even # /var/log/rkhunter.log bash: /var/log/rkhunter.log: Permission denied
What should I be doing now?
Help much appreciated! Thanks a lot.