Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server's been hacked EMERGENCY
ZeuS backend controller abusive usage

We have warned by our hosting company about there is a botnet controller (zeus) in our server. But we don't know how it is installed and how to detect and remove it.

We haven't installed any thing in near past and no clue where that controller located.

It is a dedicated server.

How can we detect it ? Antivirus softwares like CLAM AV can help to find it ?

share|improve this question

marked as duplicate by mailq, John Gardeniers, symcbean, Shane Madden, Iain Oct 9 '11 at 20:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

@mailq That linked question's been deleted by its author. – Ward Oct 3 '11 at 6:13

@Glen's answer is a good start but a good botnet installer will use a rootkit that backdoors most system utilities (so they wont show them when doing forensics). A really good one will even go to the trouble of modifying source code or libraries so even binaries compiled now will be blinded. The only real way is to have your hosting provider show you traffic logs that indicate you are compromised and confirm what is connected to that port via lsof or netstat. Which if it doesn't show anything, still doesn't mean you weren't compromised.

share|improve this answer

lsof and netstat can be useful to hunt down bots and bouncers. 'lsof -i | grep -i irc' has helped me find these in the past but I doubt that would catch everything. If you see something odd with netstat/lsof you can further investigate the pid with 'ls -lah /proc/$pid/'.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.