0

According to Dr.web there is a new linux malware called Linux.BackDoor.FakeFile.1 , it can speared throught .pdf , gedit , open-office files .. , it can execute a multiples malicious functions using the user's right ( it doesn't require root privilege ) :

It then searches for a hidden file, whose name matches the file name of the Trojan, and replaces the executable file with it. For instance, if an ELF file of Linux.BackDoor.FakeFile.1 is named AnyName.pdf, the Trojan will search for a hidden file under the name .AnyName.pdf and then replace the original file with it by using the command mv.

Because the malware is recently (added on 2016-10-14) added to Dr.Web virus database, is that possible to verify linux systems by detecting and removing the backdoor through the command line ?

1

To detect the backdoor through the command line in user's home directory:

if [ -d "~/.gconf/apps/gnome-common/" ] ; then if [ `sha1sum ~/.gconf/apps/gnome-common/gnome-common | awk '{print $1}'` = 0138fc4d50c734e288388f7c8cbbea5e2ad08a8b ] ; then  echo "Linux.BackDoor.FakeFile.1 was found!"; else echo "You havn't virus"; fi else echo "You havn't virus"; fi

I think, this backdoor virus can't start automatically. User must run it from command line. Nautilus can't start it. But if you mount /home directory without exec privileges, you can live happy!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.