Detect and remove trojans on Linux | Security Center - Security Center

Use Security Center alerts, system-level investigation, and diagnostic commands to identify and remove trojans from Linux systems.

Background

Trojans exploit unpatched vulnerabilities or weak security configurations. After removal, strengthen your defenses: apply security patches, harden permissions, audit operations, and analyze logs.

Step 1: Use Security Center to remove trojans

Handle the security alert and remove the trojan. Evaluate and handle alerts.
Immediately fix the system vulnerability. View and handle linux software vulnerabilities.

Step 2: Investigate indicators of compromise

Run last and lastlog to review recent logins for suspicious activity.
Run grep -i Accepted /var/log/secure to find IP addresses of successful remote logins.

Check for suspicious cron jobs:

cat /var/spool/cron/
cat /etc/cron.hourly
cat /etc/crontab

Run find / -ctime 1 to find recently modified files and locate the trojan.
Check the /etc/passwd and /etc/shadow files for suspicious user accounts.
Check /tmp, /var/tmp, and /dev/shm for trojan files. Attackers target these directories because they typically have 1777 permissions.
Review logs of internet-facing services (Tomcat, NGINX) for abnormal entries.
Run service --status-all | grep running to check running services for anomalies.
Run chkconfig --list | grep :on to check auto-start services for anomalies.
Run ls -lt /etc/init.d/ | head to check for abnormal startup scripts.

Step 3: Diagnostic commands

Command	Description
ps, top	Lists active processes and resource usage. Identifies abnormal processes.
pstree	Displays process relationships in a tree format.
lsof	Lists open files and the processes that opened them. Identifies which process uses a specific file or port.
netstat	Displays network connections and listening ports. Identifies IPs with excessive connections.
iftop	Monitors real-time network traffic per interface. Identifies IPs generating unusual traffic.
nethogs	Monitors per-process network traffic sorted by bandwidth. Identifies processes generating abnormal traffic.
strace	Traces system calls made by a process. Analyzes suspected trojan behavior.
strings	Extracts printable strings from a binary. Useful for analyzing suspected trojan files.