Editing Malware Issue

[[Category:Zimbra]]

'''Malware Issue faced and rectified on Linux Mail Servers'''

Symtoms
   1) Load will gradually rise.
   2) CPU Utilization will rise.
   3) Both became stable at a level(around 20 load)
   4) Wierd applications would found running when you monitor TOP. 

Steps to find out the location of malware
   1) Monitor cpu usage using TOP command
   2) Any service which is using CPU around 200% , monitor that service. 
   3) Using ps -elf | grep "--service name--"   , find out wether the service is genuine or froud. 
   4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp  or at /root/ or / ) 
   
Steps to secure our machine
   1) First of all kill that process using its PROCESS ID( mind that you use its PID)
   2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate. 
   3) Then echo > --malware--  ( empty the contents of malware fle)
   4) Then chmod 000 --malware-- 
   5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)
      ***(--malware-- has to be replaced with the name of malware present on the server, ex. meep.pl , a , b , etc.)

Usual location of these malwares 
   1) /tmp
   2) /var/tmp   --80% of times malware is found here. 
   3) /usr/tmp
   4) /root/     --hidden file would be found here ( like .kpoll ) 
   5) /          --hidden file would be found here

Victims 
   1) Systems with high end configuration (All mail servers, Basically Zimbra ones because of their high configuration)
   2) Systems with high clock frequency/ RAM/ Dedicated Graphic Card (Nvidia/AMD Radion)
   3) Systems with great uptime

''For help - malware are basically of names like - a,b,meep.sh,xd.pl,minerd,minerd32,minerd64,kpoll,fuss. and are found 80% of times at /var/tmp/''


For more details you can visit -> http://goo.gl/eOcSsn