?
Solved

How can I run Diagnostics/Virus Scan on my Linux Server?

Posted on 2008-06-23
4
Medium Priority
?
422 Views
Last Modified: 2013-12-16
I am concerned about the performance of my Linux server. It's acting... "different".

My suspicions:
10% Virus or Trojan
40% messed up configuration
50% conflicting packages in PHP

I'd really like to rule out the Virus or Trojan.

Is there some way to run a virus/trojan scan on it? (Ubuntu server 6)

Thanks for your time
0
Comment
Question by:oxygen_728
  • 2
4 Comments
 
LVL 19

Accepted Solution

by:
http:// thevpn.guru earned 500 total points
ID: 21846385
Use top and ps aux to check for CPU and Memory usage. Use jnettop to check for network traffic. Install clamav to do some AV scanning.
0
 
LVL 29

Assisted Solution

by:Jan Springer
Jan Springer earned 1000 total points
ID: 21856869
1) www.chkrootkit.org
     easy to install and run.  i use this on my machines.

2) www.mailscanner.info 
    for mail, run MailScanner, Spamassass, ClamAV

3) www.buqtraq.org
    keep on top of vulnerabilities

4) keep a spreadsheet that lists the OS and applications versions
    check them against new releases, particularly security vulnerabilities
0
 
LVL 8

Assisted Solution

by:eager
eager earned 500 total points
ID: 21859397
If you believe that your Linux system has been compromised, then anything which you run on the system will give you results which are not reliable.  Disconnect the system from the network and boot with a live CD, like Ubuntu.  Then you can run diagnostics.  

There are products like tripwire which will perform an audit of your Linux system. But most depend on your installing a known good system, then installing the product.  
0
 
LVL 29

Assisted Solution

by:Jan Springer
Jan Springer earned 1000 total points
ID: 21859819
I'm in agreement with the "if you believe .." - If that's the case, then I would rebuild the machine from scratch.  But the steps up above that I listed are important to be proactive and prevent future intrusions.

Check your httpd log files for unusual activity.  Check "/tmp" for files that shouldn't be there.

If you're using an outdated version of PHP, you stand a chance for a shell kit intrusion.  

Add to that list of security items -> modsecurity for Apache and iptables.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Fine Tune your automatic Updates for Ubuntu / Debian
Welcome back to our beginners guide of the popular Unix tool, cron. If you missed part one where we introduced this tool, the link is below. We left off learning how to build a simple script to schedule automatic back ups. Now, we’ll learn how to se…
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

569 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question