Malware in Linux

[revanb]

I have unexplained internet activity which is depleting my bandwidth and I can't stop it. It is not auto updating, I switched that off. It appears to be continual DNS requests originating from my pc. Can't tell which process. browsers, email, etc all closed.

Please help I'm so frustrated!

[Kevbert]

You could try using

sudo netstat -pant

in terminal. This will show what IPs are being used. From there you can find out more about the IP with

whois IP.Ad.dr.es

(enter the actual number after whois).
Are you running via wireless ? It may just be communication with the router or the signal may be poor - please post the output of

iwconfig

Are you using a firewall ? Please take a look at this.

[revanb]

Hi Kevbert

I am not in front of my pc at this moment, so I'll try that later when I get home. What I have done so far is as follows:



System Details:
Intel Quad Core, Ubuntu Karmic 9.10 (64-bit), 4Gb RAM

Short Description:
I have unexplained internet activity which is using up my bandwidth. About 6 KiB/s receiving and 2.5 KiB/s Sending in about 10s - 30s continuous bursts. I don't have auto-updating. It seems to have started about a week or two ago, depleting about 950 Mb.

Long Description:
I have so far:
- Closed all ports on my router
- Installed Firestarter (Firewall)
- Installed EtherApe (Graphical Network Traffic Display)
- Installed Wireshark (Packet sniffer/analyser)

I have determined that the traffic seems to be originating from my computer and the only way I can stop it is to use the Lock firewall option on Firestarter, but then all traffic is blocked and I can't use any network.

With Wireshark I determined that it seems to be DNS requests for an address simply called "A" and then responses are received saying that name doesn't exist.

I created a new account on my pc to see if it happens there as well and it does.

Consequence:
I don't how to stop it and reinstalling is not so easy since I have lot's of software and limited bandwidth. I can't leave my PC running as I normally do otherwise my bandwidth is used up. I only have 2Gb / month currently.

[skymera]

I am highly doubtful that it is malware.
Though i've not seen anything in the forums about this before =\

Try a reinstall.

And 2GB a month limit is sad It makes me cry.

[SecretCode]

And 2GB a month limit is sad It makes me cry.

That's South Africa for you

revanb - what's your network setup? Are there other PCs in the house - are you using ADSL - how are you connected to the ADSL modem (ethernet/wireless) - that kind of detail.

[revanb]

Yup, the limit makes me sad too, but I'm stuck with it right now.

I'm going to try to solve it before I reinstall, because I have so much software which will then have to be reinstalled.

[revanb]

Secretcode

I am using DSL through a Billion Router. I have other PC's too, but the main one which normally is always on is connected through a wired connection.

I have SSH and VSFTP servers running on the computer as well as a script which takes snapshots of security cameras every 5 minutes

[SecretCode]

And the extra traffic is definitely coming from your machine? It seems weird that even bursts of DNS lookups could amount to 950MB in two weeks.

[TrakerJon]

Yup, the limit makes me sad too, but I'm stuck with it right now.

I'm going to try to solve it before I reinstall, because I have so much software which will then have to be reinstalled.

This should speed things up for you a bit...

http://ubuntuforums.org/showthread.php?t=1310795

[aktiwers]

Try installing ntop.

sudo apt-get install ntop

And visit the stat page.. I think the default is:
http://localhost:3000/

It has detailed overview about in and out going connections