?
Solved

How can I run Diagnostics/Virus Scan on my Linux Server?

Posted on 2008-06-23
4
Medium Priority
?
414 Views
Last Modified: 2013-12-16
I am concerned about the performance of my Linux server. It's acting... "different".

My suspicions:
10% Virus or Trojan
40% messed up configuration
50% conflicting packages in PHP

I'd really like to rule out the Virus or Trojan.

Is there some way to run a virus/trojan scan on it? (Ubuntu server 6)

Thanks for your time
0
Comment
Question by:oxygen_728
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 19

Accepted Solution

by:
http:// thevpn.guru earned 500 total points
ID: 21846385
Use top and ps aux to check for CPU and Memory usage. Use jnettop to check for network traffic. Install clamav to do some AV scanning.
0
 
LVL 29

Assisted Solution

by:Jan Springer
Jan Springer earned 1000 total points
ID: 21856869
1) www.chkrootkit.org
     easy to install and run.  i use this on my machines.

2) www.mailscanner.info 
    for mail, run MailScanner, Spamassass, ClamAV

3) www.buqtraq.org
    keep on top of vulnerabilities

4) keep a spreadsheet that lists the OS and applications versions
    check them against new releases, particularly security vulnerabilities
0
 
LVL 8

Assisted Solution

by:eager
eager earned 500 total points
ID: 21859397
If you believe that your Linux system has been compromised, then anything which you run on the system will give you results which are not reliable.  Disconnect the system from the network and boot with a live CD, like Ubuntu.  Then you can run diagnostics.  

There are products like tripwire which will perform an audit of your Linux system. But most depend on your installing a known good system, then installing the product.  
0
 
LVL 29

Assisted Solution

by:Jan Springer
Jan Springer earned 1000 total points
ID: 21859819
I'm in agreement with the "if you believe .." - If that's the case, then I would rebuild the machine from scratch.  But the steps up above that I listed are important to be proactive and prevent future intrusions.

Check your httpd log files for unusual activity.  Check "/tmp" for files that shouldn't be there.

If you're using an outdated version of PHP, you stand a chance for a shell kit intrusion.  

Add to that list of security items -> modsecurity for Apache and iptables.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Fine Tune your automatic Updates for Ubuntu / Debian
In part one, we reviewed the prerequisites required for installing SQL Server vNext. In this part we will explore how to install Microsoft's SQL Server on Ubuntu 16.04.
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
Suggested Courses
Course of the Month10 days, 14 hours left to enroll

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question