Ubuntu Malware Removal Toolkit

Ubuntu Malware Removal Toolkit is an Ubuntu-based LiveCD focused on Windows malicious software removal. The purpose of this distribution is to create a portable environment that will make it easier to remove malware from infected Windows systems.

Features

Detect and clean Windows malware directly from the LiveCD using the best free tools
Easy to use even for Linux novice users
Custom Nautilus scripts to make easier tasks like scanning or hashing multiple files or folders
Find online informations surfing the web with Firefox directly from the LiveCD
Windows network protocols support: Ubuntu MRT can browse Windows networks, resolve Windows hostnames, mount Windows shared folders and use RDP to remotely control Windows Servers
Easily create an Ubuntu MRT Persistent LiveUSB directly from the LiveCD
Browse and query the Windows registry files, detect NTFS timestamp artifacts and much more…
Easily search online for multiple file hashes with a single mouse clic (Virustotal.com, Team Cymru MHR and others services)
Analyze network traffic using preinstalled tools like ntop and BotHunter

Identificare e rimuovere malware con Ubuntu MRT

Lo scopo di questo articolo è quello di mostrarvi come utilizzare i principali strumenti inclusi in Ubuntu MRT, nello specifico tratterò:

AVG Virus Scanner, aggiornamento via Internet e scansione
Reglookup Common Startup Locations (Script)
MiTec Windows Registry File Viewer
VirusTotal e Simple Malware Check Tool
Hashing con MD5Sum
I preferiti di Firefox
Alcuni dei comandi rapidi inclusi nel file manager “Nautilus”

Il paziente

Il sistema preso come esempio è stato infettato con un Bot-Rootkit che sembra programmato per spedire spam e sottrarre credenziali di accesso a varie tipologie di servizi Internet.
Come potete vedere nella seguente immagine il sistema non mostra particolari segni di infezione, non ci sono processi sospetti in esecuzione o in avvio automatico

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s