I fear that I'm under a linux botnet takeover.
sudo netstat -antpv with all browsers closed, besides other results, returns this:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 192.168.0.100:48090 220.127.116.11:443 TIME_WAIT - tcp 0 0 192.168.0.100:49130 18.104.22.168:443 TIME_WAIT - tcp 0 0 192.168.0.100:47830 22.214.171.124:443 TIME_WAIT - tcp 0 0 192.168.0.100:33494 126.96.36.199:443 TIME_WAIT - tcp 0 0 192.168.0.100:42121 188.8.131.52:443 TIME_WAIT - tcp 0 0 192.168.0.100:33497 184.108.40.206:443 TIME_WAIT - tcp 0 0 192.168.0.100:40590 220.127.116.11:443 TIME_WAIT -
These ip addresses keep changing. These addresses belong to
http://18.104.22.168.ipaddress.com (google) (Same for the rest of the ips in this series)
So here are my questions:
1) Am I reading this right? Assuming so-
2) How do determine the processes that are doing this
3) How do I safeguard myself. Are there any good linux antivirus solutions
4) What's happening? I can understand twitter spamming, but what about google? Are they clicking on google links for SEO?
5) How do I get rid of them pronto?