These programs will save your ass when Linux users need you to remove malware
Ha ha, this tux lovin' fool doesn't think they need antivirus protection!
Thank you XKCD.
My recent posts on tools for removing Windows malware and Mac malware were really popular. Operating systems based on Linux are a lot more commonly found on servers than on client machines. But I use Linux Mint for my everyday work, and I’ve been an Ubuntu/Debian distro client PC user for many years now. I know there are lots of us Linux client users out there, even though there are a lot fewer of us than Windows and macOS users. So, onto malware removal tools for Linux!
Yes, Android is based on a Linux kernel as well. But the popular mobile OS is treated as a separate computing platform so its app environment is different from desktop Linux. Android malware removal will be covered in another post, please look forward to it.
Like macOS, a lot of the malware that ends up on Linux machines targets vulnerabilities in Windows and Android. But there is malware which targets vulnerabilities specific to popular Linux distros. Just as many Mac users have spent years thinking that they were immune to malware, at least as many of my fellow Linux fans feel the same way about our computing platform of choice. Thinking that any operating system is immune to malware is a huge mistake!
The applications in this post can usually be used for both client and server Linux installs. There are perhaps thousands of Linux distros out there, feel free to explore DistroWatch and prepare to be overwhelmed! But the majority of Linux machines, client and server alike, are ultimately based on either Debian or Red Hat/Fedora/CentOS. Usually an application will be supported by a family of operating systems based on the same core Linux distribution. For example, the same .deb Debian package can be used in Debian, Ubuntu, Kali Linux, Kubuntu, Xubuntu, <insert GUI here>ubuntu, Linux Mint, and dozens of other operating systems that are based on Debian or Debian via Ubuntu. There are also distros like Arch Linux which can be custom built by the user to support any type of package developed for any other Linux distro! But you can expect Arch users to be technically proficient enough to find and run malware removal applications and scripts on their own without any help from you.
If you’re expected to make malware removal “house calls” then I urge you to put these applications on USB sticks, DVDs, and CDs whenever possible. If you’re doing on-site work, you should have multiple means of putting software into a machine. Be prepared for situations where you can only use an optical drive or where you can only use a USB port.
ClamAV
I use ClamAV as my everyday antivirus shield. What a great application!
I have configured ClamAV on my desktop to download signatures and run a scan of my entire HDD partition at different times once per day. Doing so is simple with the ClamTk UI.
If you have root access to a Linux machine, you can install ClamAV from the command line, update signatures and run a scan if you suspect that there’s malware. Please have the user enter their root password themselves when prompted.
ClamAV can be installed in the many distros based on Debian or Ubuntu by entering “sudo apt-get update” then “apt-get install clamav”.
If your user has CentOS or Fedora, ClamAV can be installed with yum. Especially with CentOS, be sure that you’ve set up the Extra Packages for Enterprise Linux repository by reading the instructions here.
ClamAV can be installed in Fedora with one command, “yum install -y clamav clamav update”.
With the Extra Packages for Enterprise Linux repository enabled in CentOS, enter “yum install-y epel release” then “yum install -y clamav”.
ClamAV can be installed in Red Hat by following the instructions here.
ClamAV can also be installed in Mandriva, Gentoo, and openSUSE at the command line. Enter “urpmi clamav clamd” on Mandriva, “emerge clamav” in Gentoo, and “zypper install -y clamav” in openSUSE.
Rootkit Hunter
Linux rootkits are a significant problem and it won’t surprise me at all if you’re called to remove possible rootkits on a Linux client or server.
Rootkit Hunter’s a great script, and it’s very versatile. It’s a Bourne shell script specifically, so any Linux or BSD/Unix machine with BASH can use it.
Rootkit Hunter is available as a tar.gz archive file via SourceForge. You can also ask the developer and users questions on SourceForge, something I recommend if you have any issues with the script.
chkrootkit
There’s more than one tool to find rootkits on a Linux machine. If Rootkit Hunter doesn’t work, chkrootkit is another excellent program which has been developed and supported for many years. The latest stable version was released in March 2017.
At least 70 different types of rootkits can be detected by chkrootkit. Like Rootkit Hunter, it can be run completely from BASH and it’s a very powerful tool. Because chkrootkit is a shell script, it’ll run in any operating system with a Linux kernel or a BSD/Unix kernel.
You can download archive files from their website. Extract the archive and put chkrootkit onto optical disks and USB sticks.
In my next malware removal tool piece, I’ll tackle Android. Stay tuned!
