Malware Issue - Revision history

Shashanksharma at 07:54, 24 January 2014

2014-01-24T07:54:38Z

← Older revision		Revision as of 07:54, 24 January 2014
Line 21:		Line 21:
	4) Then chmod 000 --malware--		4) Then chmod 000 --malware--
	5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)		5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)
			***(--malware-- has to be replaced with the name of malware present on the server, ex. meep.pl , a , b , etc.)

	Usual location of these malwares		Usual location of these malwares

Shashanksharma at 07:42, 24 January 2014

2014-01-24T07:42:05Z

← Older revision		Revision as of 07:42, 24 January 2014
Line 22:		Line 22:
	5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)		5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)

			Usual location of these malwares
			1) /tmp
			2) /var/tmp --80% of times malware is found here.
			3) /usr/tmp
			4) /root/ --hidden file would be found here ( like .kpoll )
			5) / --hidden file would be found here

			Victims
			1) Systems with high end configuration (All mail servers, Basically Zimbra ones because of their high configuration)
			2) Systems with high clock frequency/ RAM/ Dedicated Graphic Card (Nvidia/AMD Radion)
			3) Systems with great uptime

	''For help - malware are basically of names like - a,b,meep.sh,xd.pl,minerd,minerd32,minerd64,kpoll,fuss. and are found 80% of times at /var/tmp/''		''For help - malware are basically of names like - a,b,meep.sh,xd.pl,minerd,minerd32,minerd64,kpoll,fuss. and are found 80% of times at /var/tmp/''


			For more details you can visit -> http://goo.gl/eOcSsn

Shashanksharma at 06:38, 24 January 2014

2014-01-24T06:38:34Z

← Older revision		Revision as of 06:38, 24 January 2014
Line 3:		Line 3:
	'''Malware Issue faced and rectified on Linux Mail Servers'''		'''Malware Issue faced and rectified on Linux Mail Servers'''

	[[Symtoms]]		Symtoms
	1) Load will gradually rise.		1) Load will gradually rise.
	2) CPU Utilization will rise.		2) CPU Utilization will rise.
Line 9:		Line 9:
	4) Wierd applications would found running when you monitor TOP.		4) Wierd applications would found running when you monitor TOP.

	[[Steps to find out the location of malware]]		Steps to find out the location of malware
	1) Monitor cpu usage using TOP command		1) Monitor cpu usage using TOP command
	2) Any service which is using CPU around 200% , monitor that service.		2) Any service which is using CPU around 200% , monitor that service.
Line 15:		Line 15:
	4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp or at /root/ or / )		4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp or at /root/ or / )

	[[Steps to secure our machine]]		Steps to secure our machine
	1) First of all kill that process using its PROCESS ID( mind that you use its PID)		1) First of all kill that process using its PROCESS ID( mind that you use its PID)
	2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate.		2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate.

Shashanksharma at 06:37, 24 January 2014

2014-01-24T06:37:35Z

← Older revision		Revision as of 06:37, 24 January 2014
Line 1:		Line 1:
	[[Category:Zimbra]]		[[Category:Zimbra]]

	[['''Malware Issue faced and rectified on Linux Mail Servers''']]		'''Malware Issue faced and rectified on Linux Mail Servers'''

	[[Symtoms]]		[[Symtoms]]
	1) Load will gradually rise.		1) Load will gradually rise.
	2) CPU Utilization will rise.		2) CPU Utilization will rise.
Line 15:		Line 15:
	4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp or at /root/ or / )		4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp or at /root/ or / )

	[[Steps to secure our machine]]		[[Steps to secure our machine]]
	1) First of all kill that process using its PROCESS ID( mind that you use its PID)		1) First of all kill that process using its PROCESS ID( mind that you use its PID)
	2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate.		2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate.

Shashanksharma: Created page with "Category:Zimbra '''Malware Issue faced and rectified on Linux Mail Servers''' Symtoms 1) Load will gradually rise. 2) CPU Utilization will rise. 3) Bot..."

2014-01-24T06:35:23Z

Created page with "Category:Zimbra '''Malware Issue faced and rectified on Linux Mail Servers''' Symtoms 1) Load will gradually rise. 2) CPU Utilization will rise. 3) Bot..."

New page

[[Category:Zimbra]]

[['''Malware Issue faced and rectified on Linux Mail Servers''']]

[[Symtoms]]
1) Load will gradually rise.
2) CPU Utilization will rise.
3) Both became stable at a level(around 20 load)
4) Wierd applications would found running when you monitor TOP.

[[Steps to find out the location of malware]]
1) Monitor cpu usage using TOP command
2) Any service which is using CPU around 200% , monitor that service.
3) Using ps -elf | grep "--service name--" , find out wether the service is genuine or froud.
4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp or at /root/ or / )

[[Steps to secure our machine]]
1) First of all kill that process using its PROCESS ID( mind that you use its PID)
2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate.
3) Then echo > --malware-- ( empty the contents of malware fle)
4) Then chmod 000 --malware--
5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)

''For help - malware are basically of names like - a,b,meep.sh,xd.pl,minerd,minerd32,minerd64,kpoll,fuss. and are found 80% of times at /var/tmp/''