3

I think my Linux laptop has been hacked, for three reasons:

  1. Whenever I saved files into the Home folder, the files wouldn't appear - not even in the other folders on my computer.

  2. An unfamiliar .txt file has showed up in my Home folder. Having noticed it, I didn't open it. I immediately had a suspicion that maybe my laptop has been hacked.

  3. When checking my Firewall status, it turned out that it was inactive.

Thus, I have taken the following steps:

  1. I backed-up all of my recent files using two USB Sticks that aren't as important as other USB Sticks which I own - so in case those USB Sticks get infected with the potential malware, it wouldn't infect my other backed-up important files.

  2. I've used ClamTK in order to scan the aforementioned suspicious file - but apparently, for some reason, it hasn't detected any threats.

  3. I've used chkrootkit for another scan. This is the output (up until that point, nothing seemed to have been infected):

    Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found:  
    /usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/debug/.build-id /lib/modules/4.13.0-39-generic/vdso/.build-id /lib/modules/4.13.0-37-generic/vdso/.build-id /lib/modules/4.10.0-38-generic/vdso/.build-id /lib/modules/4.13.0-36-generic/vdso/.build-id /lib/modules/4.13.0-32-generic/vdso/.build-id /lib/modules/4.13.0-38-generic/vdso/.build-id
    /usr/lib/debug/.build-id /lib/modules/4.13.0-39-generic/vdso/.build-id /lib/modules/4.13.0-37-generic/vdso/.build-id /lib/modules/4.10.0-38-generic/vdso/.build-id /lib/modules/4.13.0-36-generic/vdso/.build-id /lib/modules/4.13.0-32-generic/vdso/.build-id /lib/modules/4.13.0-38-generic/vdso/.build-id
    

    And also:

    Searching for Linux/Ebury - Operation Windigo ssh...        Possible Linux/Ebury - Operation Windigo installetd
    
  4. I was trying - twice - to scan my laptop with F-PROT, with fpscan, using Ultimate Boot CD. But when I tried getting into the PartedMagic section of the disc in order to use the tool, it just wouldn't work. Twice. So I was not able to use it whatsoever.

  5. When typing sudo freshclam, I got the following output:

    ERROR: /var/log/clamav/freshclam.log is locked by another process
    ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
    
  6. Then, I scanned the computer using rkhunter. These are the warnings I got:

      /usr/bin/lwp-request                                     [ Warning ]
    
      Performing filesystem checks
        Checking /dev for suspicious file types                  [ Warning ]
        Checking for hidden files and directories                [ Warning ]
    

    And this is the summary:

    System checks summary
    =====================
    
    File properties checks...
        Files checked: 143
        Suspect files: 1
    
    Rootkit checks...
        Rootkits checked : 365
        Possible rootkits: 0
    
    Applications checks...
        All checks skipped
    
    The system checks took: 1 minute and 10 seconds
    
    All results have been written to the log file: /var/log/rkhunter.log
    
    One or more warnings have been found while checking the system.
    Please check the log file (/var/log/rkhunter.log)
    

So, after all that - I do not have access to the rkhunter log file as root:

n-even@neven-Lenovo-ideapad-310-14ISK ~ $ sudo su
neven-Lenovo-ideapad-310-14ISK n-even # /var/log/rkhunter.log
bash: /var/log/rkhunter.log: Permission denied

What should I be doing now?

Help much appreciated! Thanks a lot.

migrated from askubuntu.com May 7 '18 at 9:00

This question came from our site for Ubuntu users and developers.

  • 2
    You could be out of space or out of inodes. – Binar Web May 7 '18 at 8:51
  • 1
    What is this text file? What is its name? – terdon May 7 '18 at 9:02
  • 1
    This is a plain text document. Its name is: DEADJOE – N Even May 7 '18 at 9:16
  • 1
    @NEven DEADJOE is from the text editor JOE. It's benign. – dsstorefile1 May 7 '18 at 9:25
  • 6
    You are trying to run the log file. Use cat /var/log/rkhunter.log. – jjmontes May 7 '18 at 16:36
19

Based on the details in your question, your system is clean.

  1. You're making backups. OK.

  2. clamav comes up clean. That's fine, too.

  3. Based on your output of chkrootkit, your system is clean. Those files listed as suspicious are benign. The Ebury/Windigo detection is a false positive: https://github.com/Magentron/chkrootkit/issues/1

  4. Some of the live discs you tried didn't work. That's OK.

  5. There might already be an updater running as a daemon.

  6. You're trying to execute the log file. View it in a pager instead, like less /var/log/rkhunter.log.

From a logical standpoint, chkrootkit and rkhunter aren't of much use if they are used to scan the same system they execute on since they are not realtime scanners thus any decently packaged rootkit would have sabatoged the scanners before they are run. Also, both have heuristics that result in plenty of false positives.

The saved files not appearing are rarely an indication of system compromise. Without knowing the contents of the "suspicious" .txt file you mention, there can be no conclusion drawn from that. DEADJOE is a backup file created by the JOE text editor. The firewall in Linux Mint is disabled by default.

Edit: Added info on DEADJOE file.

11
neven-Lenovo-ideapad-310-14ISK n-even # /var/log/rkhunter.log
bash: /var/log/rkhunter.log: Permission denied

You are trying to execute a log file. Of course that fails; the +x bit is probably not set for it.

You want to read the log file, not execute it. Try sudo less /var/log/rkhunter.log.

  • 2
    +1 and sudo cat /var/log/rkhunter.log | less would be even better to minimise the amount of unnecessary privileges. Sometimes I paste long texts into the the wrong window and it does weird things to terminal programs like less that accept a wide range of commands, e. g. save the current buffer to a file, overwriting its current content in the process. Imagine if I pasted a SE answer about the dangers of rm -rf and less finds an interprets the substring ! rm -rf --no-preserve-root /. – David Foerster May 7 '18 at 15:38
  • 1
    A move convoluted way without pipes or excessive privileges would be to (1) gain super-user privileges, (2) open the file and then (3) drop the privileges again: sudo sh -c 'exec sudo -u "$SUDO_USER" less < "$1"' _ /var/log/rkhunter.log – David Foerster May 7 '18 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.