Page 1 of 8 123 ... LastLast
Results 1 to 10 of 75

Thread: Virus in ubuntu

  1. #1
    Join Date
    Nov 2013
    Beans
    33

    Virus in ubuntu

    Hi,

    I am new to linux/ubuntu. I think my ubunut caught a virus. When ever i login to ubunto account, it will automatically download something from an ip with using up all my network bandwidth ( an ip address in China). I can not see which program is downloading data by using nethogs or iftop. Can somebody help me to find out what is going on?

    here is the picture of nethogs and iftop.

    NetHogs version 0.8.0


    PID USER PROGRAM DEV SENT RECEIVED
    ? root ..50:56629-117.25.130.43:84 0.000 515.732 KB/sec
    ? root unknown TCP 0.000 0.000 KB/sec


    TOTAL 0.000 515.732 KB/sec





    191Mb 381Mb 572Mb 763Mb 954Mb
    └───────────────┴───────────────┴───────────────┴─ ──────────────┴───────────────
    ubuntu.local => 117.25.130.43 0b 0b 0b
    <= 4.91Mb 4.91Mb 4.90Mb
    192.168.126.255 => 192.168.126.129 0b 0b 0b
    <= 0b 187b 88b
    192.168.126.255 => 192.168.126.136 0b 0b 0b
    <= 0b 187b 47b
    ubuntu.local => 224.0.0.251 0b 0b 160b
    <= 0b 0b 0b
    ubuntu.local => 192.168.126.2 0b 0b 44b
    <= 0b 0b 80b
    255.255.255.255 => 192.168.126.129 0b 0b 0b
    <= 0b 0b 66b
    255.255.255.255 => 192.168.126.136 0b 0b 0b
    <= 0b 0b 66b
    ubuntu.local => 192.168.126.255 0b 0b 52b
    <= 0b 0b 0b




    ────────────────────────────────────────────────── ──────────────────────────────
    TX: cum: 2.18kB peak: 1.38kb rates: 0b 0b 256b
    RX: 29.2MB 4.91Mb 4.91Mb 4.91Mb 4.90Mb
    TOTAL: 29.2MB 4.91Mb 4.91Mb 4.91Mb 4.90Mb
    Attached Images Attached Images

  2. #2
    Join Date
    Mar 2010
    Location
    Squidbilly-Land
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: Virus in ubuntu

    What does ss show?
    You should see the sort of traffic and ports.

  3. #3
    Join Date
    Nov 2008
    Location
    Boston MetroWest
    Beans
    16,326

    Re: Virus in ubuntu

    I'd start by blocking that IP address by adding these lines to /etc/rc.local and rebooting:

    Code:
    /sbin/iptables -I INPUT  -s 117.25.130.43 -j DROP
    /sbin/iptables -I OUTPUT -d 117.25.130.43 -j DROP
    Then you can do some forensics without having to worry about what kinds of traffic you are sending to that address. Do any of these domains look familiar?
    If you ask for help, do not abandon your request. Please have the courtesy to check for responses and thank the people who helped you.

    Blog · Linode System Administration Guides · Android Apps for Ubuntu Users

  4. #4
    Join Date
    Nov 2013
    Beans
    33

    Re: Virus in ubuntu

    Hi TheFu,

    Thanks for helping. Here is the ss result. Not sure what to look for.


    Code:
    Netid  State      Recv-Q Send-Q   Local Address:Port       Peer Address:Port   
    u_str  ESTAB      0      0                    * 15782                 * 15783  
    u_str  ESTAB      0      0                    * 15470                 * 15471  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 9699                  * 9698   
    u_str  ESTAB      0      0                    * 20370                 * 20369  
    u_str  ESTAB      0      0                    * 20333                 * 20334  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 17783                 * 16898  
    u_str  ESTAB      0      0                    * 11585                 * 10064  
    u_str  ESTAB      0      0                    * 9727                  * 10666  
    u_str  ESTAB      0      0                    * 16682                 * 16339  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15601                 * 15600  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15112                 * 15110  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 13587                 * 13586  
    u_str  ESTAB      0      0                    * 20039                 * 21639  
    u_str  ESTAB      0      0                    * 16312                 * 16673  
    u_str  ESTAB      0      0                    * 16636                 * 16261  
    u_str  ESTAB      0      0                    * 8802                  * 8801   
    u_str  ESTAB      0      0                    * 18084                 * 19792  
    u_str  ESTAB      0      0                    * 15557                 * 15558  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16388                 * 15915  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 8730                  * 698    
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16387                 * 15914  
    u_str  ESTAB      0      0                    * 20372                 * 20371  
    u_str  ESTAB      0      0                    * 15784                 * 15785  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15558                 * 15557  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16625                 * 16208  
    u_str  ESTAB      0      0                    * 16904                 * 17788  
    u_str  ESTAB      0      0                    * 14250                 * 14251  
    u_str  ESTAB      7381   0                    * 15117                 * 15122  
    u_str  ESTAB      0      0                    * 16047                 * 16526  
    u_str  ESTAB      0      0                    * 20374                 * 20373  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 14696                 * 14085  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16692                 * 16691  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 15913                 * 15912  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 15641                 * 15152  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16617                 * 16181  
    u_str  ESTAB      0      768    @/tmp/.X11-unix/X0 19787                 * 18076  
    u_str  ESTAB      0      0      @/dbus-vfs-daemon/socket-mQcOWs76 17781                 * 16858  
    u_str  ESTAB      0      0      /var/run/acpid.socket 9848                  * 9847   
    u_str  ESTAB      0      0                    * 15777                 * 15778  
    u_str  ESTAB      0      0                    * 20314                 * 20313  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 20034                 * 20033  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16104                 * 16560  
    u_str  ESTAB      0      0                    * 16398                 * 16399  
    u_str  ESTAB      0      0                    * 14251                 * 14250  
    u_str  ESTAB      0      0                    * 16275                 * 16276  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15539                 * 15538  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 12102                 * 12101  
    u_str  ESTAB      0      0                    * 20318                 * 20319  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 15911                 * 15910  
    u_str  ESTAB      0      0                    * 638                   * 639    
    u_str  ESTAB      0      0                    * 20313                 * 20314  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15272                 * 15245  
    u_str  ESTAB      0      0                    * 14914                 * 14913  
    u_str  ESTAB      0      0                    * 15398                 * 15399  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 8972                  * 8970   
    u_str  ESTAB      0      0                    * 15780                 * 15781  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 14951                 * 15382  
    u_str  ESTAB      0      0                    * 8537                  * 8546   
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 18002                 * 18001  
    u_str  ESTAB      0      0                    * 14886                 * 14887  
    u_str  ESTAB      0      0                    * 19785                 * 19786  
    u_str  ESTAB      0      0      @/tmp/.ICE-unix/2952 17788                 * 16904  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16308                 * 16307  
    u_str  ESTAB      0      0                    * 15275                 * 15276  
    u_str  ESTAB      0      0                    * 15602                 * 15603  
    u_str  ESTAB      0      0                    * 14972                 * 14973  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15754                 * 15753  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 15586                 * 15585  
    u_str  ESTAB      0      0                    * 20362                 * 20361  
    u_str  ESTAB      0      0                    * 16858                 * 17781  
    u_str  ESTAB      0      0                    * 16232                 * 16233  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 16461                 * 16460  
    u_str  ESTAB      0      0                    * 15273                 * 15274  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16337                 * 16679  
    u_str  ESTAB      0      0                    * 20329                 * 20330  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 21639                 * 20039  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 17924                 * 17042  
    u_str  ESTAB      0      0                    * 14997                 * 15401  
    u_str  ESTAB      0      0                    * 17743                 * 17744  
    u_str  ESTAB      0      0                    * 20364                 * 20363  
    u_str  ESTAB      0      0                    * 16606                 * 16145  
    u_str  ESTAB      0      0                    * 16067                 * 16528  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 17998                 * 19771  
    u_str  ESTAB      0      0                    * 16855                 * 16856  
    u_str  ESTAB      0      0                    * 9847                  * 9848   
    u_str  ESTAB      0      0                    * 15693                 * 15694  
    u_str  ESTAB      0      0                    * 20334                 * 20333  
    u_str  ESTAB      0      0                    * 19789                 * 19790  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16389                 * 15359  
    u_str  ESTAB      0      0                    * 20366                 * 20365  
    u_str  ESTAB      0      0                    * 17795                 * 17796  
    u_str  ESTAB      0      0                    * 16181                 * 16617  
    u_str  ESTAB      0      0                    * 16307                 * 16308  
    u_str  ESTAB      0      0                    * 14314                 * 14320  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15075                 * 15074  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 9539                  * 10445  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 17606                 * 16840  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16639                 * 16270  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15276                 * 15275  
    u_str  ESTAB      0      0                    * 18274                 * 19885  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15411                 * 15410  
    u_str  ESTAB      0      0                    * 19795                 * 19796  
    u_str  ESTAB      0      0                    * 20368                 * 20367  
    u_str  ESTAB      0      0                    * 20328                 * 20327  
    u_str  ESTAB      0      0      @/com/ubuntu/upstart-session/1000/2686 14319                 * 14935  
    u_str  ESTAB      0      0                    * 16773                 * 16775  
    u_str  ESTAB      0      0                    * 16077                 * 16559  
    u_str  ESTAB      0      0                    * 9214                  * 9215   
    u_str  ESTAB      0      0                    * 16073                 * 16529  
    u_str  ESTAB      0      0                    * 698                   * 8730   
    u_str  ESTAB      0      0                    * 15885                 * 15355  
    u_str  ESTAB      0      0                    * 18085                 * 19793  
    u_str  ESTAB      0      0                    * 20352                 * 20351  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16905                 * 17791  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16144                 * 16577  
    u_str  ESTAB      0      0                    * 20323                 * 20324  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16673                 * 16312  
    u_str  ESTAB      0      0                    * 22576                 * 22577  
    u_str  ESTAB      0      0                    * 15689                 * 0      
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15002                 * 15408  
    u_str  ESTAB      0      0                    * 14935                 * 14319  
    u_str  ESTAB      0      0                    * 15691                 * 15692  
    u_str  ESTAB      0      0                    * 15979                 * 15980  
    u_str  ESTAB      0      0                    * 20354                 * 20353  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 17790                 * 17789  
    u_str  ESTAB      0      0                    * 16837                 * 17598  
    u_str  ESTAB      0      0                    * 930                   * 8975   
    u_str  ESTAB      0      0      @/dbus-vfs-daemon/socket-JD5WCS5s 16775                 * 16773  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15800                 * 15295  
    u_str  ESTAB      0      0                    * 15005                 * 15006  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 14244                 * 14873  
    u_str  ESTAB      0      0                    * 15408                 * 15002  
    u_str  ESTAB      0      0                    * 16343                 * 16344  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16470                 * 16024  
    u_str  ESTAB      0      0                    * 15277                 * 15795  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15598                 * 15597  
    u_str  ESTAB      0      0                    * 15074                 * 15075  
    u_str  ESTAB      0      0                    * 20356                 * 20355  
    u_str  ESTAB      0      0                    * 19886                 * 19887  
    u_str  ESTAB      0      0                    * 17789                 * 17790  
    u_str  ESTAB      0      0                    * 15359                 * 16389  
    u_str  ESTAB      0      0                    * 14085                 * 14696  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 16247                 * 16246  
    u_str  ESTAB      0      0                    * 15897                 * 16386  
    u_str  ESTAB      0      0                    * 14947                 * 14323  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 14973                 * 14972  
    u_str  ESTAB      0      0                    * 15658                 * 15659  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 14939                 * 14938  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 18275                 * 19888  
    u_str  ESTAB      0      0                    * 16632                 * 16633  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 21576                 * 21575  
    u_str  ESTAB      0      0                    * 16819                 * 17573  
    u_str  ESTAB      0      0                    * 20358                 * 20357  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 8975                  * 930    
    u_str  ESTAB      0      0                    * 18005                 * 19775  
    u_str  ESTAB      0      0                    * 16691                 * 16692  
    u_str  ESTAB      0      0                    * 14718                 * 14719  
    u_str  ESTAB      0      0                    * 20339                 * 20340  
    u_str  ESTAB      0      0                    * 16270                 * 16639  
    u_str  ESTAB      0      0                    * 15864                 * 15360  
    u_str  ESTAB      0      0      @/dbus-vfs-daemon/socket-zQZmhXvc 17595                 * 16828  
    u_str  ESTAB      0      0      @/tmp/.ICE-unix/2952 15980                 * 15979  
    u_str  ESTAB      0      0      @/com/ubuntu/upstart-session/1000/2686 15370                 * 14948  
    u_str  ESTAB      0      0                    * 15660                 * 15661  
    u_str  ESTAB      0      0                    * 20360                 * 20359  
    u_str  ESTAB      0      0                    * 16462                 * 16463  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16396                 * 16394  
    u_str  ESTAB      0      0                    * 20342                 * 20341  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16809                 * 16808  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 17464                 * 17463  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16130                 * 16562  
    u_str  ESTAB      0      0                    * 15217                 * 15749  
    u_str  ESTAB      0      0                    * 649                   * 650    
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15920                 * 15919  
    u_str  ESTAB      0      0                    * 16780                 * 16781  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 15905                 * 15904  
    u_str  ESTAB      0      0                    * 8970                  * 8972   
    u_str  ESTAB      0      0                    * 20344                 * 20343  
    u_str  ESTAB      0      0                    * 17791                 * 16905  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15087                 * 15086  
    u_str  ESTAB      32     0                    * 18076                 * 19787  
    u_str  ESTAB      0      0                    * 15007                 * 15008  
    u_str  ESTAB      0      0                    * 639                   * 638    
    u_str  ESTAB      0      0                    * 20332                 * 20331  
    u_str  ESTAB      0      0      @/tmp/.ICE-unix/2952 16812                 * 16811  
    u_str  ESTAB      0      0                    * 17463                 * 17464  
    u_str  ESTAB      0      0                    * 15218                 * 15750  
    u_str  ESTAB      0      0      @/com/ubuntu/upstart-session/1000/2686 14323                 * 14947  
    u_str  ESTAB      0      0                    * 20320                 * 20321  
    u_str  ESTAB      0      0                    * 15919                 * 15920  
    u_str  ESTAB      0      0      @/com/ubuntu/upstart 8714                  * 8644   
    u_str  ESTAB      0      0                    * 20346                 * 20345  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16815                 * 16814  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 16233                 * 16232  
    u_str  ESTAB      0      0                    * 16562                 * 16130  
    u_str  ESTAB      0      0                    * 14413                 * 13773  
    u_str  ESTAB      0      0                    * 19771                 * 17998  
    u_str  ESTAB      0      0      @/com/ubuntu/upstart 9115                  * 9113   
    u_str  ESTAB      0      0                    * 20331                 * 20332  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 14998                 * 15402  
    u_str  ESTAB      0      0                    * 20319                 * 20318  
    u_str  ESTAB      0      0                    * 17042                 * 17924  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 17566                 * 16804  
    u_str  ESTAB      0      0                    * 20348                 * 20347  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 19792                 * 18084  
    u_str  ESTAB      0      0                    * 16530                 * 16074  
    u_str  ESTAB      0      0                    * 15902                 * 15903  
    u_str  ESTAB      0      0                    * 15399                 * 15398  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 8907                  * 8906   
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16216                 * 16215  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 15401                 * 14997  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 15588                 * 15587  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15785                 * 15784  
    u_str  ESTAB      0      0                    * 9196                  * 9197   
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 17569                 * 16806  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 14930                 * 14310  
    u_str  ESTAB      0      0                    * 20350                 * 20349  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 16207                 * 16206  
    u_str  ESTAB      0      0                    * 16577                 * 16144  
    u_str  ESTAB      0      0                    * 20315                 * 20316  
    u_str  ESTAB      0      0                    * 16637                 * 16262  
    u_str  ESTAB      0      0                    * 13560                 * 13299  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 14887                 * 14886  
    u_str  ESTAB      0      0                    * 16898                 * 17783  
    u_str  ESTAB      0      0                    * 16206                 * 16207  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15286                 * 15278  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15781                 * 15780  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 8885                  * 835    
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15783                 * 15782  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 9197                  * 9196   
    u_str  ESTAB      0      0                    * 20371                 * 20372  
    u_str  ESTAB      0      0                    * 20335                 * 20336  
    u_str  ESTAB      0      0                    * 16208                 * 16625  
    u_str  ESTAB      0      0                    * 16394                 * 16396  
    u_str  ESTAB      0      0                    * 14963                 * 14964  
    u_str  ESTAB      0      0                    * 13586                 * 13587  
    u_str  ESTAB      0      0                    * 15086                 * 15087  
    u_str  ESTAB      0      0                    * 20033                 * 20034  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 19885                 * 18274  
    u_str  ESTAB      0      0                    * 15915                 * 16388  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15424                 * 15423  
    u_str  ESTAB      0      0                    * 20373                 * 20374  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16022                 * 16466  
    u_str  ESTAB      0      0                    * 15914                 * 16387  
    u_str  ESTAB      0      0                    * 20326                 * 20325  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16609                 * 16174  
    u_str  ESTAB      0      0                    * 15278                 * 15286  
    u_str  ESTAB      0      0                    * 10445                 * 9539   
    u_str  ESTAB      0      0                    * 15538                 * 15539  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 14964                 * 14963  
    u_str  ESTAB      0      0      @/com/ubuntu/upstart 8546                  * 8537   
    u_str  ESTAB      0      0                    * 20338                 * 20337  
    u_str  ESTAB      0      0                    * 20327                 * 20328  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16528                 * 16067  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16339                 * 16682  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16856                 * 16855  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16633                 * 16632  
    u_str  ESTAB      0      0                    * 16471                 * 16472  
    u_str  ESTAB      0      0                    * 16174                 * 16609  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 19793                 * 18085  
    u_str  ESTAB      0      0                    * 15912                 * 15913  
    u_str  ESTAB      0      0      @/com/ubuntu/upstart-session/1000/2686 14320                 * 14314  
    u_str  ESTAB      0      0                    * 20337                 * 20338  
    u_str  ESTAB      0      0      /run/user/1000/pulse/native 16399                 * 16398  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 15471                 * 15470  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 9453                  * 9191   
    u_str  ESTAB      0      0                    * 8801                  * 8802   
    u_str  ESTAB      0      0                    * 16466                 * 16022  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15778                 * 15777  
    u_str  ESTAB      0      0                    * 14938                 * 14939  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 16262                 * 16637  
    u_str  ESTAB      0      0                    * 15910                 * 15911  
    u_str  ESTAB      0      0                    * 15100                 * 15101  
    u_str  ESTAB      0      0                    * 15295                 * 15800  
    u_str  ESTAB      0      0                    * 20361                 * 20362  
    u_str  ESTAB      0      0                    * 17796                 * 17795  
    u_str  ESTAB      0      0                    * 16452                 * 15982  
    u_str  ESTAB      0      0                    * 15003                 * 15004  
    u_str  ESTAB      0      0                    * 15152                 * 15641  
    u_str  ESTAB      0      0                    * 12097                 * 12098  
    u_str  ESTAB      0      37888  @/com/ubuntu/upstart-session/1000/2686 15122                 * 15117  
    u_str  ESTAB      0      0                    * 17571                 * 17572  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 15469                 * 15468  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 17923                 * 17922  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 9215                  * 9214   
    u_str  ESTAB      0      0                    * 20363                 * 20364  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 15982                 * 16452  
    u_str  ESTAB      0      0                    * 9369                  * 9160   
    u_str  ESTAB      0      0                    * 16752                 * 16767  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15274                 * 15273  
    u_str  ESTAB      0      0                    * 15600                 * 15601  
    u_str  ESTAB      0      0                    * 19786                 * 19785  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 19784                 * 18030  
    u_str  ESTAB      0      0                    * 14256                 * 14890  
    u_str  ESTAB      0      0                    * 16024                 * 16470  
    u_str  ESTAB      0      0                    * 20365                 * 20366  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16145                 * 16606  
    u_str  ESTAB      0      0      /run/user/1000/pulse/native 15953                 * 15952  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 19775                 * 18005  
    u_str  ESTAB      0      0                    * 12101                 * 12102  
    u_str  ESTAB      0      0                    * 20340                 * 20339  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15694                 * 15693  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 16779                 * 16778  
    u_str  ESTAB      0      0                    * 20367                 * 20368  
    u_str  ESTAB      0      0                    * 16840                 * 17606  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 16607                 * 16605  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 9160                  * 9369   
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 724                   * 8807   
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 12098                 * 12097  
    u_str  ESTAB      0      0                    * 19796                 * 19795  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 16559                 * 16077  
    u_str  ESTAB      0      0                    * 14873                 * 14244  
    u_str  ESTAB      0      0                    * 18030                 * 19784  
    u_str  ESTAB      0      0                    * 15110                 * 15112  
    u_str  ESTAB      0      0                    * 14913                 * 14914  
    u_str  ESTAB      0      0                    * 690                   * 691    
    u_str  ESTAB      0      0                    * 20369                 * 20370  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 19790                 * 19789  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 16529                 * 16073  
    u_str  ESTAB      0      0      @/tmp/.ICE-unix/2952 16472                 * 16471  
    u_str  ESTAB      0      0                    * 8644                  * 8714   
    u_str  ESTAB      0      0                    * 16828                 * 17595  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 15661                 * 15660  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 650                   * 649    
    u_str  ESTAB      0      0                    * 20325                 * 20326  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15355                 * 15885  
    u_str  ESTAB      0      0                    * 15597                 * 15598  
    u_str  ESTAB      0      0                    * 15410                 * 15411  
    u_str  ESTAB      0      0                    * 21986                 * 21987  
    u_str  ESTAB      0      0                    * 20353                 * 20354  
    u_str  ESTAB      0      0                    * 16608                 * 16172  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 15004                 * 15003  
    u_str  ESTAB      0      6144   @/tmp/.X11-unix/X0 11519                 * 11518  
    u_str  ESTAB      0      0                    * 9698                  * 9699   
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 17598                 * 16837  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16344                 * 16343  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15795                 * 15277  
    u_str  ESTAB      0      0                    * 15587                 * 15588  
    u_str  ESTAB      0      0      @/dbus-vfs-daemon/socket-yR3jWo2E 16767                 * 16752  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15692                 * 15691  
    u_str  ESTAB      0      0                    * 20355                 * 20356  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 17572                 * 17571  
    u_str  ESTAB      0      0                    * 16460                 * 16461  
    u_str  ESTAB      0      0                    * 15585                 * 15586  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 10666                 * 9727   
    u_str  ESTAB      0      0      @/dbus-vfs-daemon/socket-fRmQ1PzB 17744                 * 17743  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 14890                 * 14256  
    u_str  ESTAB      0      0                    * 9191                  * 9453   
    u_str  ESTAB      0      0      @/dbus-vfs-daemon/socket-IGrACA5Z 22577                 * 22576  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 691                   * 690    
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16526                 * 16047  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 15603                 * 15602  
    u_str  ESTAB      0      0                    * 20336                 * 20335  
    u_str  ESTAB      0      0                    * 15245                 * 15272  
    u_str  ESTAB      0      0                    * 21575                 * 21576  
    u_str  ESTAB      0      0                    * 18001                 * 18002  
    u_str  ESTAB      0      0                    * 20357                 * 20358  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16463                 * 16462  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 19887                 * 19886  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15360                 * 15864  
    u_str  ESTAB      0      0                    * 15423                 * 15424  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 14719                 * 14718  
    u_str  ESTAB      0      0                    * 16246                 * 16247  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15807                 * 15304  
    u_str  ESTAB      0      0                    * 14937                 * 14940  
    u_str  ESTAB      320    0                    * 11518                 * 11519  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 15659                 * 15658  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16781                 * 16780  
    u_str  ESTAB      0      0                    * 20359                 * 20360  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 17573                 * 16819  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 16276                 * 16275  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 13773                 * 14413  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 13485                 * 13484  
    u_str  ESTAB      0      0                    * 19888                 * 18275  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 15101                 * 15100  
    u_str  ESTAB      0      0      @/tmp/.ICE-unix/2952 19791                 * 18083  
    u_str  ESTAB      0      0                    * 16778                 * 16779  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 13299                 * 13560  
    u_str  ESTAB      0      0                    * 20343                 * 20344  
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 16172                 * 16608  
    u_str  ESTAB      0      0                    * 16811                 * 16812  
    u_str  ESTAB      0      0                    * 15468                 * 15469  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15749                 * 15217  
    u_str  ESTAB      0      0                    * 20341                 * 20342  
    u_str  ESTAB      0      0                    * 15952                 * 15953  
    u_str  ESTAB      0      0                    * 15904                 * 15905  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 14940                 * 14937  
    u_str  ESTAB      0      0                    * 20345                 * 20346  
    u_str  ESTAB      0      0                    * 17785                 * 17786  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 16074                 * 16530  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15750                 * 15218  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 16261                 * 16636  
    u_str  ESTAB      0      0                    * 9113                  * 9115   
    u_str  ESTAB      0      0      @/tmp/.X11-unix/X0 15006                 * 15005  
    u_str  ESTAB      0      0                    * 16814                 * 16815  
    u_str  ESTAB      0      0      /var/run/dbus/system_bus_socket 10064                 * 11585  
    u_str  ESTAB      0      0                    * 20321                 * 20320  
    u_str  ESTAB      0      0                    * 17921                 * 17039  
    u_str  ESTAB      0      0                    * 20347                 * 20348  
    u_str  ESTAB      0      0                    * 20316                 * 20315  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 17786                 * 17785  
    u_str  ESTAB      0      0                    * 16804                 * 17566  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 15903                 * 15902  
    u_str  ESTAB      0      0                    * 18083                 * 19791  
    u_str  ESTAB      0      0                    * 15753                 * 15754  
    u_str  ESTAB      0      0                    * 15382                 * 14951  
    u_str  ESTAB      0      0                    * 835                   * 8885   
    u_str  ESTAB      0      0                    * 20330                 * 20329  
    u_str  ESTAB      0      0                    * 17922                 * 17923  
    u_str  ESTAB      0      0                    * 14948                 * 15370  
    u_str  ESTAB      0      0                    * 8906                  * 8907   
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 21987                 * 21986  
    u_str  ESTAB      0      0                    * 16806                 * 17569  
    u_str  ESTAB      0      0                    * 20349                 * 20350  
    u_str  ESTAB      0      0                    * 20324                 * 20323  
    u_str  ESTAB      0      0                    * 16215                 * 16216  
    u_str  ESTAB      0      0                    * 16605                 * 16607  
    u_str  ESTAB      0      0                    * 9538                  * 0      
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 15008                 * 15007  
    u_str  ESTAB      0      0      @/tmp/dbus-HysINZGdbr 16386                 * 15897  
    u_str  ESTAB      0      0                    * 15402                 * 14998  
    u_str  ESTAB      0      0                    * 15304                 * 15807  
    u_str  ESTAB      0      0      @/tmp/dbus-dvQCtMLigc 17039                 * 17921  
    u_str  ESTAB      0      0                    * 16679                 * 16337  
    u_str  ESTAB      0      0                    * 20351                 * 20352  
    u_str  ESTAB      0      0                    * 16808                 * 16809  
    u_str  ESTAB      0      0                    * 16560                 * 16104  
    u_str  ESTAB      0      0                    * 14310                 * 14930  
    u_str  ESTAB      0      0                    * 13484                 * 13485  
    u_str  ESTAB      0      0                    * 8807                  * 724

  5. #5
    Join Date
    Nov 2013
    Beans
    33

    Re: Virus in ubuntu

    Hi SeijiSensei,

    Thanks for the info. No, i don't see any familiar site in the domains list. What are those domains? Virus sites? I might go to one of the sites by mistake. I don't know. I will add the lines to the rc.local file. thanks.

  6. #6
    Join Date
    Mar 2010
    Location
    Squidbilly-Land
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: Virus in ubuntu

    Holy crap!!!! My desktop had 5 lines - all were to specific IP addresses either inside or outside my network. It was clear that http, ssh, ftp, samba or imap were being used.

    I don't have any of that dbus crap. Unity? I can't imagine trying to secure all that stuff.

  7. #7
    Join Date
    Nov 2013
    Beans
    33

    Re: Virus in ubuntu

    Hi SeijiSensei,

    After i added the two lines to the rc.local file and rebooted. It still downloads data from the Chinese IP.

    Code:
    NetHogs version 0.8.0
    
    
      PID USER     PROGRAM                      DEV        SENT      RECEIVED       
    ?     root     ..50:56629-117.25.130.43:84             0.000     540.868 KB/sec
    ?     root     unknown TCP                             0.000       0.000 KB/sec
    
    
      TOTAL                                                0.000     540.868 KB/sec 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
                    191Mb           381Mb           572Mb           763Mb      954Mb
    └───────────────┴───────────────┴───────────────┴───────────────┴───────────────
    ubuntu.local               => 117.25.130.43                 0b      0b      0b
                               <=                            4.91Mb  4.42Mb  4.42Mb
    ubuntu.local               => 192.168.126.2                 0b    288b    288b
                               <=                               0b    463b    463b
    ubuntu.local               => 224.0.0.251                 568b    645b    645b
                               <=                               0b      0b      0b
    ubuntu.local               => 91.189.89.199                 0b     76b     76b
                               <=                               0b     76b     76b
    ubuntu.local               => 91.189.94.4                   0b     76b     76b
                               <=                               0b     76b     76b
    ubuntu.local               => 224.0.0.22                    0b     40b     40b
                               <=                               0b      0b      0b
    
    
    
    
    
    
    
    
    
    
    
    
    ────────────────────────────────────────────────────────────────────────────────
    TX:             cum:   1.10kB   peak:   1.41kb  rates:    568b   1.10kb  1.10kb
    RX:                    4.42MB           4.91Mb           4.91Mb  4.42Mb  4.42Mb
    TOTAL:                 4.42MB           4.91Mb           4.91Mb  4.42Mb  4.42Mb

  8. #8
    Join Date
    Nov 2013
    Beans
    33

    Re: Virus in ubuntu

    Hi TheFu,

    I am not sure if i understand what you are saying. Can you be more specific? Thanks

  9. #9
    Join Date
    Mar 2010
    Location
    Squidbilly-Land
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: Virus in ubuntu

    Well, the fact that is controlled by root is just scary.
    sudo iptables -L
    should show the REJECT rules entered before. If not, perhaps a different control channel is sending everything outbound.
    Have you installed any software from outside the Canonical repos?

  10. #10
    Join Date
    Nov 2013
    Beans
    33

    Re: Virus in ubuntu

    Hi TheFu,

    try sudo iptables -L. Here is the result. I always use the software center or apt-get install command to install new applications.

    I am not sure how i got this virus. It must be the time when i browse the internet.

    Code:
    ubuntu2@ubuntu:~$ sudo iptables -L
    Chain INPUT (policy DROP)
    target     prot opt source               destination         
    DROP       all  --  117.25.130.43        anywhere            
    ufw-before-logging-input  all  --  anywhere             anywhere            
    ufw-before-input  all  --  anywhere             anywhere            
    ufw-after-input  all  --  anywhere             anywhere            
    ufw-after-logging-input  all  --  anywhere             anywhere            
    ufw-reject-input  all  --  anywhere             anywhere            
    ufw-track-input  all  --  anywhere             anywhere            
    
    
    Chain FORWARD (policy DROP)
    target     prot opt source               destination         
    ufw-before-logging-forward  all  --  anywhere             anywhere            
    ufw-before-forward  all  --  anywhere             anywhere            
    ufw-after-forward  all  --  anywhere             anywhere            
    ufw-after-logging-forward  all  --  anywhere             anywhere            
    ufw-reject-forward  all  --  anywhere             anywhere            
    
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination         
    DROP       all  --  anywhere             117.25.130.43       
    ufw-before-logging-output  all  --  anywhere             anywhere            
    ufw-before-output  all  --  anywhere             anywhere            
    ufw-after-output  all  --  anywhere             anywhere            
    ufw-after-logging-output  all  --  anywhere             anywhere            
    ufw-reject-output  all  --  anywhere             anywhere            
    ufw-track-output  all  --  anywhere             anywhere            
    
    
    Chain ufw-after-forward (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-after-input (1 references)
    target     prot opt source               destination         
    ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:netbios-ns
    ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:netbios-dgm
    ufw-skip-to-policy-input  tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn
    ufw-skip-to-policy-input  tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds
    ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:bootps
    ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:bootpc
    ufw-skip-to-policy-input  all  --  anywhere             anywhere             ADDRTYPE match dst-type BROADCAST
    
    
    Chain ufw-after-logging-forward (1 references)
    target     prot opt source               destination         
    LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
    
    
    Chain ufw-after-logging-input (1 references)
    target     prot opt source               destination         
    LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
    
    
    Chain ufw-after-logging-output (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-after-output (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-before-forward (1 references)
    target     prot opt source               destination         
    ufw-user-forward  all  --  anywhere             anywhere            
    
    
    Chain ufw-before-input (1 references)
    target     prot opt source               destination         
    ACCEPT     all  --  anywhere             anywhere            
    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
    ufw-logging-deny  all  --  anywhere             anywhere             state INVALID
    DROP       all  --  anywhere             anywhere             state INVALID
    ACCEPT     icmp --  anywhere             anywhere             icmp destination-unreachable
    ACCEPT     icmp --  anywhere             anywhere             icmp source-quench
    ACCEPT     icmp --  anywhere             anywhere             icmp time-exceeded
    ACCEPT     icmp --  anywhere             anywhere             icmp parameter-problem
    ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
    ACCEPT     udp  --  anywhere             anywhere             udp spt:bootps dpt:bootpc
    ufw-not-local  all  --  anywhere             anywhere            
    ACCEPT     udp  --  anywhere             224.0.0.251          udp dpt:mdns
    ACCEPT     udp  --  anywhere             239.255.255.250      udp dpt:1900
    ufw-user-input  all  --  anywhere             anywhere            
    
    
    Chain ufw-before-logging-forward (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-before-logging-input (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-before-logging-output (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-before-output (1 references)
    target     prot opt source               destination         
    ACCEPT     all  --  anywhere             anywhere            
    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
    ufw-user-output  all  --  anywhere             anywhere            
    
    
    Chain ufw-logging-allow (0 references)
    target     prot opt source               destination         
    LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] "
    
    
    Chain ufw-logging-deny (2 references)
    target     prot opt source               destination         
    RETURN     all  --  anywhere             anywhere             state INVALID limit: avg 3/min burst 10
    LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
    
    
    Chain ufw-not-local (1 references)
    target     prot opt source               destination         
    RETURN     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL
    RETURN     all  --  anywhere             anywhere             ADDRTYPE match dst-type MULTICAST
    RETURN     all  --  anywhere             anywhere             ADDRTYPE match dst-type BROADCAST
    ufw-logging-deny  all  --  anywhere             anywhere             limit: avg 3/min burst 10
    DROP       all  --  anywhere             anywhere            
    
    
    Chain ufw-reject-forward (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-reject-input (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-reject-output (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-skip-to-policy-forward (0 references)
    target     prot opt source               destination         
    DROP       all  --  anywhere             anywhere            
    
    
    Chain ufw-skip-to-policy-input (7 references)
    target     prot opt source               destination         
    DROP       all  --  anywhere             anywhere            
    
    
    Chain ufw-skip-to-policy-output (0 references)
    target     prot opt source               destination         
    ACCEPT     all  --  anywhere             anywhere            
    
    
    Chain ufw-track-input (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-track-output (1 references)
    target     prot opt source               destination         
    ACCEPT     tcp  --  anywhere             anywhere             state NEW
    ACCEPT     udp  --  anywhere             anywhere             state NEW
    
    
    Chain ufw-user-forward (1 references)
    target     prot opt source               destination         
    
    
    Chain ufw-user-input (1 references)
    target     prot opt source               destination         
    DROP       tcp  --  117.25.130.43        117.25.130.43        tcp spt:84 dpt:200
    DROP       udp  --  117.25.130.43        117.25.130.43        udp spt:84 dpt:200
    
    
    Chain ufw-user-limit (0 references)
    target     prot opt source               destination         
    LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] "
    REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
    
    
    Chain ufw-user-limit-accept (0 references)
    target     prot opt source               destination         
    ACCEPT     all  --  anywhere             anywhere            
    
    
    Chain ufw-user-logging-forward (0 references)
    target     prot opt source               destination         
    
    
    Chain ufw-user-logging-input (0 references)
    target     prot opt source               destination         
    
    
    Chain ufw-user-logging-output (0 references)
    target     prot opt source               destination         
    
    
    Chain ufw-user-output (1 references)
    target     prot opt source               destination

Page 1 of 8 123 ... LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •