Diff for "detect_malware" - Creative Computing Wiki

Differences between revisions 1 and 3 (spanning 2 versions)

major way to detect malware first top and see if any process use lot of cpu

cat /proc/pid/pwd to see which dir it run in and see any suspicious files in it and delete it

rm files <-- if no permission, then chmod, if still no permission then lsattr
lsattr files <-- check if have is immutable if yes remove it
chattr -i -a files <-- remove immutable flags. then rm again
rm files

2,load up backup and compare files different.

mkdir /mnt/backfil/ <-- make a dir to mount at
ls /dev/vd* <-- list the back up device
mount /dev/vdc1 /mnt/backfil <-- mount the backup device to file
cd  / <-- goes to root dir
rsync -avn /mnt/backfil/ ./ | less <--compare file differents, n is important testing mode.

3,compare the file different and find any suspisious file , e.g, file in etc/, some service executables, copy the file from backup.
- example /etc/ssh/ has been changed , rsynd it from mounts

cd /etc/ssh/
rsync -av /mnt/backfil/etc/ssh/ ./

-  ⇤ ← Revision 1 as of 2023-01-27 02:43:27 → 
  Size: 162
  Editor: cpe-58-167-147-38
  Comment:
+   ← Revision 3 as of 2023-01-27 04:11:09 → ⇥
  Size: 1006
  Editor: cpe-58-167-147-38
  Comment:
-Deletions are marked like this.
+Additions are marked like this.
 Line 1:
-major way to detect malware
first top and see if any process use lot of cpu
1, cat /proc/pid/pwd to see which dir it run in and see any suspicious files in it
+major way to detect malware first top and see if any process use lot of cpu

 1. cat /proc/pid/pwd to see which dir it run in and see any suspicious files in it and delete it

{{{
rm files <-- if no permission, then chmod, if still no permission then lsattr
lsattr files <-- check if have is immutable if yes remove it
chattr -i -a files <-- remove immutable flags. then rm again
rm files
}}}
   2,load up backup and compare files different.

{{{
mkdir /mnt/backfil/ <-- make a dir to mount at
ls /dev/vd* <-- list the back up device
mount /dev/vdc1 /mnt/backfil <-- mount the backup device to file
cd  / <-- goes to root dir
rsync -avn /mnt/backfil/ ./ | less <--compare file differents, n is important testing mode.
}}}
   3,compare the file different and find any suspisious file , e.g, file in etc/, some service executables,  copy the file from backup.

     example /etc/ssh/ has been changed , rsynd it from mounts

{{{
cd /etc/ssh/
rsync -av /mnt/backfil/etc/ssh/ ./
}}}