Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

if I am looking for a virus/spyware under linux, where should I have to look for to find it ?

I suspect to be the target of very skilled hackers. 5 or 6 years ago I found a spyware on my linux box, it was lkm masked as ppp_deflate module with md5 hash hijacked. I mean with the same md5 hash of the original ppp_deflate. So my question is not "please advice me some kind of antirootkit tool" neither "Please give me some kind of malware for linux". I tryied different kinds of antirootkit tools but all had not worked. And my question is: I suspect I have a spyware on my linux box, where should I look for find this spyware ? kernel ? lkm ? libc ? binary ? initrd ? gnome limited process ? Then it's a kind of forensic question.. thanks

share|improve this question

closed as not a real question by Scott Pack, Gilles, Rory Alsop Apr 11 '12 at 9:21

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Are you looking for malware which targets Linux systems or are you looking for tools which run on linux for managing malware? –  symcbean Apr 11 '12 at 8:22
add comment

1 Answer 1

Viruses and spyware are rare on Linux. You can try Clam Antivirus, but generally speaking it is not worth the time. Generally speaking, it is better to spend your time hardening your Linux desktop and hardening your Linux servers, rather than worrying about anti-virus scanners. Anti-virus scanners are primarily a Windows thing.

Why do you ask?

share|improve this answer
1  
@Gilles, could be possible reopen this question ? –  user45 Apr 13 '12 at 21:43
    
@user45, you might be better off posting a totally new question, rather than revising the current one to add a lot of new information. Make sure to read the FAQ and provide all necessary background information: e.g., what Linux distribution and kernel you are using, and how you know (or why you suspect) you are infected with a virus/spyware. –  D.W. Apr 14 '12 at 0:44
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.