wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

3) Untar the source file

tar xvzf maldetect-current.tar.gz

4) Install Linux Malware Detect
From the step 3, I saw the the folder of source files is maldetect-1.4.1

cd maldetect-1.4.1
./install.sh

It will show the installation result, the most important part is the config file location.

It is /usr/local/maldetect/conf.maldet
5) Modify the config file

vi /usr/local/maldetect/conf.maldet

Change the email_addr to the email you can receive the scan result.
All other options are well commented, or self-explained.
6) Run the scan command to scan the files under folder /home

maldet --scan-all /home

The result will send to your email changed on step 5.
After installation, it will add a cron job to the system. Do the daily updating and scanning.

The post How to install Linux Malware Detect on CentOS 6.3 appeared first on David Yin's Blog.

I click the like they provided. It is a picture. It is just an image file with jpg extension. I can open it in the browser. But I want to do even more to investigate.
So I download it and use Notepad++, which is a free open source text editor software, to open it. At the end of the file, the harmful content is shown as below:

Now it is clean, one user of the website upload the picture file to website. He may not know it has problem. He may got it from the other site.
I open the jpg file with Photoshop, and save as another file. Then upload it to overwrite the old file on web server.
After that, I click rescan button on http://www.c-sirt.org site. Later the result is green. Incident is solved.
The second part of Burst.net email said I have to respond in 24 hours. So I reply the email to abuse@burst.net. Tell them what I did.
The url in the email is just one jpg file. I think maybe more than one has same issue. So I download all jpg files from the upimg folder, which stores all images files uploaded by site users.
Notepad++ has a function, call Find in files. Search “iframe” in all files under this folder including sub-folders.

The result is that I found 4 more jpg files with same iframe code.
The solutions is download it, photoshop open it, save as it, upload and overwrite it. Done.

The post Abuse Alert from Burst.net – HTML/PicFrame.Gen appeared first on David Yin's Blog.