0

I am new in my company and since a week I discovered that the company linux server contains a virus..tying to figure out what is the cause of the virus infection I noticed that the server is not up to date since a long time!! and I think but not sure this is the cause why the virus hacked the system.

Via terminal the lsb_release -a command displays the following:

No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 5.0.10 (lenny)
Release:    5.0.10
Codename:   lenny

I know, this too old (lenny!!) and I have to upgrade the system to Debian 7.0 Wheezy.The questions are:

  • What risks could happen after the update procedure?
  • Have to reinstall all the system files from scratch?
  • Have I after that to update php and mysql versions too to be compatible with the new Debian version?

I am hesitating since the versions is too old and my knowledge in linux server is very limited.

6
  • Updating really is not the way forward - you really need to completely reinstall from scratch.
    – user9517
    Commented Mar 27, 2014 at 9:43
  • Also, depending on how important this server is, you should consider to hire a consultant with actual linux expertise to get things working again.
    – Sven
    Commented Mar 27, 2014 at 9:44
  • @Iain thx but the question is not duplicate since I fixed the virus issues and I want to protect the system from next hack alternatives
    – amani
    Commented Mar 27, 2014 at 9:46
  • 3
    @amani: If you have no experience with Linux, how are you sure you have fixed the issue? I've decades of experience and would never be sure. Nuke from orbit. Read the linked question. Act accordingly.
    – Sven
    Commented Mar 27, 2014 at 9:49
  • 1
    If you have not completely wiped the machine then it could have a rootkit that is hiding aspects of the infection to ALL tools of ANY type(excluding hardware). Linux has some of the best rootkits around.
    – rob
    Commented Mar 27, 2014 at 11:01

2 Answers 2

1

If you have a rootkit on the machine (the most damaging virus), it will most likely have inserted code into your kernel modules (so it can hide itself when using normal detection tools like md5sum or netstat), and to libraries (so that other tools installed other than normal detective ones will similarly be nobbled).

There are a number of tools which are worth having, compiled with all libraries insernally, sash, ps, netstat and md5sum being the main ones.

If you don't know what you're doing, then identifying the extent of a rootkit can be neigh on impossible. When I've been hit in the past, as soon as I've identified behaviour which I'm absolutely sure, shows a malicious invader, I shut down the machine, buy new disks, do a fresh install, update and lock down the new box, and only then get access to the old disks to recover data.

If you're running a very old version of linux (I still have one server running 8.04LTS), then ensure you only run the bare minimum of internet facing services, and monitor the server regularly. If anything changes unexpectedly, then you need to get on in fast, as a bot hacker can go from exploiting something minor, to adding user level scripts, in hours. If possible keep the syslog on a different machine.

If you're not an experienced sysadmin, then seriously, heed the advice given by others, you need to keep it up to date, or you're taking a huge risk.

0

This should be a comment but it's a bit long.

"company linux server contains a virus"

This immediately sets my alarm bells ringing. Viruses on Linux are exceedingly rare. There are lots of other malware (worms, trojans, rootkits). If it's a fileserver then it may just be storing the virus that another computer wrote there. Upgrading the OS won't help. It will help with most of the other types of malware - but the existence of these implies a vulnerability which may have been in the OS, but it may have been in the config or in code running on the server which is not part of the OS (e.g. a web based content management system) which will not be fixed by upgrading the OS.

Sure upgrade the OS if you want to be seen to be doing something. But if you tell us as much asyou know about the incident then there's a possibility that we might be able to help you make the machine a bit more secure.

4
  • This is my question and description that I have posted according to this issue link … I have knew that something is going wrong from 3 signs:1.Anti-virus indicates a virus existing once I try to brownse my website 2.Code injection in my files 3.Email frm the hosting company saying that a virus do exist in the server...What I really need is a complete analyse for the situation to be able to handle it ..but I coudnt because like I said knowledge in linux are framed.
    – amani
    Commented Mar 27, 2014 at 13:00
  • So not a virus then. Your website is unlikely to use software from the OS distro - upgrading your OS won't fix the observed problem. Your really need to take your site offline until it gets fixed. But you seem to be somewhat out of your depth here. You might want to hire someone with some knowledge in the subject.
    – symcbean
    Commented Mar 27, 2014 at 13:13
  • 'Your really need to take your site offline until it gets fixed' How could I know if it was really fixed I tried my own to fix the problem but I coudnt find a rootkit file.If if the system is once attaked should it contain a rootkit file ?
    – amani
    Commented Mar 27, 2014 at 13:39
  • This is why you need more than help than can be provided here.
    – symcbean
    Commented Mar 27, 2014 at 13:47

Not the answer you're looking for? Browse other questions tagged .