Identify and Stop Malicious Processes
Before removing anything, it's crucial to identify and stop any active malicious processes to prevent further harm. This ensures that the package isn't running in the background while you're trying to take it off your system.
- Open your terminal. You can usually find it in your applications menu or by pressing
Ctrl + Alt + T. - List all running processes and look for anything suspicious using
ps aux | less. Pay attention to processes with high CPU or memory usage that you don't recognise. - If you identify a suspicious process, find its Process ID (PID) from the previous command.
- Stop the suspicious process using
sudo kill [PID], replacing[PID]with the actual process ID. Be very careful with this step as stopping essential system processes can cause instability. If in doubt, consult a more experienced user.
Important
Incorrectly stopping system processes can lead to system instability or data loss. Proceed with caution.
Remove the Malicious Package
Once any active processes are stopped, the next step is to remove the malicious package itself using your system's package manager. This prevents the package from being run again.
- Determine the exact name of the malicious package. If you're unsure, you can search your package manager's installed list, for example,
dpkg -l | grep [package_name_fragment]for Debian/Ubuntu orrpm -qa | grep [package_name_fragment]for Red Hat/Fedora. - For Debian/Ubuntu-based systems, remove the package using
sudo apt-get remove --purge [package_name]. The--purgeoption also removes configuration files. - For Red Hat/Fedora-based systems, remove the package using
sudo dnf remove [package_name]orsudo yum remove [package_name].
Good to know
The
--purge option in apt-get is important for removing all traces of the package.Clean Up Residual Configuration Files
Even after removing a package, some residual configuration files might remain. It's good practice to clean these up to ensure a complete removal and prevent potential issues later.
- Use your package manager to check for orphaned or leftover configuration files. For Debian/Ubuntu, try
sudo apt-get autoremoveto remove dependencies that are no longer needed. - Manually check common configuration directories for any files related to the removed package, such as
/etc/,/opt/, or your home directory's hidden files (e.g.,~/.config/or~/.local/). - If you find any remaining configuration files or directories, delete them with
sudo rm -rf [file_or_directory_path]. Be extremely careful with this command, as it permanently deletes files without a Recycle Bin.
Important
The
rm -rf command is powerful and unforgiving; double-check your path before executing.Remove the Package's PPA (Personal Package Archive)
If the malicious package was installed from a PPA, it's essential to remove that PPA from your system's sources to prevent future unwanted installations or updates from that source. This helps maintain the integrity of your software sources.
- For Debian/Ubuntu-based systems, list your PPAs to identify the one associated with the malicious package using
grep -r ppa /etc/apt/sources.list.d/. - Once identified, remove the PPA using
sudo add-apt-repository --remove ppa:[ppa_name/ppa]. You'll need to know the exact PPA name. - Alternatively, you can manually delete the PPA's
.listfile from/etc/apt/sources.list.d/withsudo rm /etc/apt/sources.list.d/[ppa_name].list. - After removing a PPA, always update your package lists using
sudo apt-get updateto reflect the changes.
Tip
Regularly reviewing your PPA list helps ensure peace of mind regarding the software sources on your system.
Tags:
Linux Security
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers