2

So a few days ago, I've noticed the new pattern with PC fan speeds on my Fedora workstation. Every now and then some of the fans will start spinning slightly faster than usual and will continue to do so for about 30 second to one minute. This happens in very light PC usage scenarios such as web browsing, pdf reading... I've noticed, because I had never been able to actually hear fans in my PC in such light usage scenarios before.

Anyway, this could be caused by myriad of things but as a basic sanity check, I wanted to rule out malware. So I did a following:

  • check lmsensors and there are indeed small spikes (~100-150rpm) in both CPU and GPU fans
  • run clamscan
  • check process tree for suspicious entries with ps and top
  • check open tcp/udp ports for suspicious entries with netstat
  • check cron/anacron files

and nothing suspicious came out.

What are some other basic things I can check to rule out malware? Should I maybe use some other applications for open port or running process listing?

Again this is basic sanity check more than anything. I don't think there is a high chance of my PC actually being infected - I haven't installed anything that is not in official repositories (apart from some GoG games), I always check web pages with Virustotal before visiting them for the first time, I always browse in private mode so caches are cleared on shutdown and I use uBlock Origin with all included filters on.

Improve this question
4
  • rpm -pV can verify an individual package on rpm based systems. So a loop over installed packages can tell you if any file installed is incorrect. Will not catch extra files. Commented Mar 22, 2021 at 22:31
  • 1
    Thanks for the tip. As a slight addendum, rpm has also -a option to select all installed packages, so one can run rpm -Va to verify all installed packages in one go. Commented Mar 23, 2021 at 0:05
  • rkhunter checks for some IoCs, but its main feature (checksumming your binaries) will not help you at this point Commented Mar 23, 2021 at 11:27
  • @Panki Thx for the tip. I had kind of always assumed that using both ClamAV and rkhunter is redundant. But I've been reading up about rkhunter for last two days and it seems that I was wrong and rkhunter indeed has a few tricks of its own. Though you're right in that checksumming binaries is not relevant in my use case. The only way to make it work without prior property database creation is to instruct rkhunter to use package manager file property verification via --pkgmgr option. But this is redundant to aforementioned rpm -Va command. Commented Mar 24, 2021 at 20:06

1 Answer 1

Reset to default
1

You can use Lynis which is a vulnerability detecting and malware scanning tool that scans systems for security information and issues, configuration errors; performs firewall auditing, examines installed software, file integrity, file/directory permissions, etc.

Improve this answer
1
  • Lynis even recommends malware checking software like rkhunter. Commented Apr 23, 2024 at 5:06

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.