spyware cleaner

Message

Guest · #1 Post by **Guest** » 2006-03-14 17:25

hi!

Need tips on how to search for spyware on my Debian.

Any nice application for that?

anon · #2 Post by **anon** » 2006-03-15 12:32

chkrootkit
(I was going to say something funny here)

Lavene · #3 Post by **Lavene** » 2006-03-15 13:31

For good measure; install rkhunter too...

What kind og "spyware" problem do you have by the way?

Tina

Guest · #4 Post by **Guest** » 2006-03-15 22:37

Many Thanks for your tips!

I manage to install chkrootkit.
Run chkrootkit and found nothing. (that's good)

Try to:
apt-get install rkhunter
No luck (that's not good)

What kind of spyware ..
I don't know. It's difficult to know what spy’s are doing..

Some days ago, I have a lot off SYN_RCVD in my firewall log. Coming . from IP 61.58.41.89. And a lot off CONNECT to port 25 in my Apache log. I blocked out thus nice Taiwan boys (or maybe “dejlige” girls). Then I looked at my machine I asked myself –have they installed something? Hard to answer that question!

Maybe try to find something to check it -or am I only very paranoid…

Lavene · #5 Post by **Lavene** » 2006-03-16 04:34

Anonymous wrote:Try to:
apt-get install rkhunter
No luck (that's not good)

That's strange:

# apt-cache search --names-only rkhunter
rkhunter - rootkit, backdoor, sniffer and exploit scanner

What branch of Debian are you using (stable, testing or unstable)? What error message do you get?

Tina

Mr_Goth · #6 Post by **Mr_Goth** » 2006-03-16 06:21

I'm loving these programs!! I feel much safer now scanning my system with these programs

Thanks!!!

Guest · #7 Post by **Guest** » 2006-03-16 08:26

What branch of Debian are you using (stable, testing or unstable)? What error message do you get?

I'm using stable

LinuS:~#
LinuS:~# apt-cache search --names-only rkhunter
LinuS:~#
LinuS:~#

no rkhunter hit for me..

kink · #8 Post by **kink** » 2006-03-16 11:50

A tool like chkrootkit is not really a solution, just an extra helper to detect problems with "dumb" hackers (because anyone with root can easily manipulate chkrootkit itself). With good system security, you need not to worry about "spyware". Only installing packages from the official Debian archive is a good start, and update your system regularly from the security archives.

There's a number of documents telling you how to further secure your system, google around for it.

Lavene · #9 Post by **Lavene** » 2006-03-16 12:55

I agree with you kink, but they do offer some peace of mind in a moment of panic if you feel your system is behaving strangely. And chkrootkit also states that fact in it's description. And unless you are a 'dumb user' it's the 'dumb hackers' that, by sheer numbers, are the largets threat... People doing shot-gun attacks (can you say that in english?) on a random list of ip adresses hoping to get some lucky hits with brute force attempts with ssh logins etc.

A determined hacker is a whole different story though, but rarely something the 'average user' will have to fear...

But as always; the best security is acheved mostly by using your head.

Tina

Carlosinfl · #10 Post by **Carlosinfl** » 2006-03-16 14:13

I never knew it was even possible to get spyware on a Linux system. Is this a known issue?

Lavene · #11 Post by **Lavene** » 2006-03-16 14:54

Carloswill wrote:I never knew it was even possible to get spyware on a Linux system. Is this a known issue?

It's not really "spyware" in the Windows meaning of the word. It's more malichious software known as root-kits. That is, someone manages to place some software with root priviliges. It's really not a big problem if you manage your system in a sound way. Like never installing software you don't know the origin of, never share your passwords etc. Plain common sense really...

But traditional spyware like dataminers etc known from Windows is not a Linux problem.

Tina

Carlosinfl · #12 Post by **Carlosinfl** » 2006-03-16 17:17

^

Thanks for the clarification!

Guest · #13 Post by **Guest** » 2006-03-16 18:54

Interesting...
I have, so fare, only Debian code on my machine (and update/upgrade regularly).
And my root password is pretty safe:
r-o-o-t-S866@&%%%FgtrYjkpl7g%mnHyt

I can’t find rkhunter - Debian version.
And maybe it doesn’t matter…
Think I also: apt-get remove chkrootkit

And go back to my normal life…

Something to do is maybe to take away things I don’t need
ex: mail, ssh, …

Guest · #14 Post by **Guest** » 2006-03-16 23:26

rkhunter isn't in the stable repostitories, only in testing & unstable.

saunatonttu · #15 Post by **saunatonttu** » 2006-03-17 00:09

I'm not too much worried about my server being insecure, at least at the moment when it's still behind a firewall router, but I installed chkrootkit and it found:

eth0: PACKET SNIFFER(/usr/bin/dhcpd[1234])
eth1:0: PACKET SNIFFER(/sbin/dhclient[2345])
eth1: PACKET SNIFFER(/sbin/dhclient[2345])

A false alarm?

saunatonttu · #16 Post by **saunatonttu** » 2006-03-17 03:35

saunatonttu wrote:A false alarm?

Yep.
http://linux.derkeiler.com/Mailing-List ... /3413.html

Debian User Forums

spyware cleaner

spyware cleaner

Great!!