The tag has no usage guidance.

learn more… | top users | synonyms (1)

0
votes
0answers
15 views

Protection against in-memory malware [on hold]

What can I do/use to protect my computer against in-memory malware (where the payload is only decrypted in-memory) ?
0
votes
0answers
19 views

replace long text string (script with MANY special characters). sed, awk, grep

My site was hacked / infected. I replaced the url of the malicious link, but other elements in the malicious script are still making my site get blocked. Without inserting a hundred or so "escapes", ...
-2
votes
0answers
9 views

Is Snort Ossec Bro Dragon supports automatic scan? [on hold]

I want to ask if malware detection systems such as Snort Ossec Bro Dragon supports automatic scan for malware
0
votes
1answer
24 views

Steps to follow when you run untrusted program with elevated priviledges

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script. The script ran without asking for a password so I ...
0
votes
0answers
20 views

I found a “Mr. Black” virus in (2) locations on local disk (Ubuntu Wily Werewolf 15.10): [closed]

I found a "Mr. Black" local virus at (2) locations: 1st location>/bin, filename busybody (/bin/busybody) 2nd location>/sbin/, filename ldconfig.real (/sbin/ldconfig.real) I deleted these from the ...
-1
votes
0answers
18 views

Is netstat a good tool to check for viruses connection?

My big questions is: How can we detect a virus both in Windows and Linux besides laying all our cards in Antivirus?! I know a rootkit can alter some commands like ls netstat and so on. My sister had ...
3
votes
2answers
108 views

Compromised server with malware “/usr/bin/fuck” and “/usr/bin/fake.cfg”

I am not asking what to do with an compromised box. Specifically, I am asking if anybody has experience with hack/malware amongst other files leaves files "/usr/bin/fake.cfg" and "/usr/bin/fuck". ...
0
votes
2answers
130 views

How to remove a script tag from a text file with sed

I have a number of header.php files that have a malicious script tag contained within them (don't ask). I've written a not-so-elegant shell script to replace these with blank space. I had initially ...
-2
votes
1answer
37 views

ClamAV installation problem?

My USB has windows viruses in it. Before attaching it to device(windows installed), I want to delete these viruses but i have kali installed device also from which I want this action to be done. I got ...
0
votes
1answer
55 views

Detect Viruses in USB?

My USB pen brings often Windows Viruses in it. Before attaching it to windows again I would prefer to delete viruses. I have Kali Linux. Is there any way to detect Windows viruses/threats through ...
3
votes
1answer
67 views

Oracle's VirtualBox and keyloggers

So, I have installed Windows 7 in Oracle's VirtualBox (5.0.8) and I would like to know if the Windows 7 software (including viruses and malware) is able in the default VirtualBox settings access the ...
0
votes
1answer
185 views

Files getting reverted to older version

One of my site was infested with malware once and since then I am seeing every alternate day the header.php files are getting reverted back to older versions (possibly by a script) and a malicious ...
1
vote
1answer
42 views

Thoughts on security in linux [closed]

So ransomware is around again - at least in Denmark. This is a major issue for MS-Windows users, but does almost never affect Linux or Mac. The reason is an issue of debate. But since the consumer ...
2
votes
2answers
621 views

Web server infected by backdoor Trojan, how to fix?

Recently, my linux server sends a very large file (10mb-10G/s outside at certain times, but I can't figure out what is the cause. Here is the screen shot i use clamav to scan all files and got the ...
1
vote
1answer
55 views

Linux and being black listed

I have some experience with Linux, currently running Ubuntu 14.04.2 LTS. I've disabled (a long time ago) root login - via ssh or webmin. I've changed my tomcat's username (good luck to the f**kers ...
0
votes
1answer
47 views

How to know which computer is trying to access a specific host

At my workplace we tend to get those annoying captchas once in a while when we are trying for search something in Google. When we got into that page it says that our network is trying to access ...
2
votes
0answers
37 views

How often are user repositories abused? [closed]

No matter which distribution you use, you probably have a package manager and most likely installed one or two packages from an "unofficial source", meaning a regular user has provided it. As ...
2
votes
1answer
382 views

Exploit FOUND with clamav on Fedora 21 in Oracle's java

I'm scanning one of my systems with Clamav like this: $ clamscan -r -i --remove --max-filesize=4000M --max-scansize=4000M \ --exclude=/proc --exclude=/sys --exclude=/dev ...
0
votes
2answers
59 views

Is this an argument that Linux security is not impenetrable?

From what I understand, the biggest and probably only line of defense against unauthorized software (viruses and worms) from being installed on the system is to simply not allow it unless an admin ...
-2
votes
3answers
75 views

Is linux secure? [duplicate]

Is linux free from almost all security vulnerabilities when compared with windows? If there are so, can i install any patches to fix them? Thanks in advance.
0
votes
0answers
116 views

Errors when installing Maldet on an Fedora 20 system, have had these before

I just installed maldetect-1.4.2 on a system(Fedora 20) and it gives this error when installing: gzip: stdin: unexpected end of file tar: Child returned status 1 tar: Error is not ...
1
vote
2answers
180 views

How can I do a virus scan on a Linux CD or ISO from windows?

I am going to try some Linux live CDs made by individuals. I want to make sure that it doesn't contain malware. How do I do it?
1
vote
1answer
92 views

unix system with malware

I have a CENTOS server that is infected with malware: top shows there's an unknown process that's consuming all the CPUs, if you kill it, it respawns with a different name. what's the best way to ...
0
votes
3answers
375 views

Unknown cause for redirect on 80 port

I have an Ubuntu 14.04 server with Apache 2.4.7 running there, hosting one site on 80 port. Today I discovered that every request to 80 port redirects to another website with response: HTTP/1.1 301 ...
2
votes
3answers
416 views

find who sends spam

I have a LAMP Ubuntu 10.04 server. There are many (>140) users and a lot of different web PHP sites (custom, different PHP frameworks, CMS etc). The problem is: sometimes the server sends "spam". And ...
1
vote
3answers
39 views

Is RPM able to control the files in home folder without confirmation?

RPM extension file can be run by double clicking no matter what's inside the package, and then it asks for the root password in order to install something to your system, but if I don't give it, will ...
3
votes
1answer
230 views

Tons of unknown connections in nethogs

I am seeing hundreds of different connections to the same ip and port scrolling by when running nethogs. Occasionally the foreign IP and port will change (not always 80, but sometimes). I've noticed ...
5
votes
3answers
1k views

Shellshock: Why this error when testing for vulnerability

I am using Fedora 20 on two machines. Having read about the Shellshock vulnerability, just now at 1100ish UTC on September 26th 2014, in UK, after a yum update bash to protect against it, I tried ...
2
votes
0answers
259 views

API Monitoring and Hooking

I am currently reading the "Malware Analyst's Cookbook and DVD". There is a chapter "Dynamic Analysis" and there are also some recipes about hooking and monitoring API calls of process but it is for ...
2
votes
0answers
653 views

How do I stop the “Green double-underlined links pop-up ads” adware in Chromium?

Summary: In the Chromium web browser (Debian), can you tell me how get rid of whatever is causing the behaviour called "Green Double-Underlined Links pop-up ads"? I'd like to stop the behaviour, not ...
1
vote
1answer
109 views

What is the exact function of this malicious bash one-liner?

I can't figure out what this is trying to do. The part between backticks looks like a plain old forkbomb, but the base64 doesn't seem to decode to anything sensible. Can you help? Don't run it, ...
2
votes
1answer
393 views

A window asking me to enter my ssh passphrase is popping up randomly. Why?

I'm on Ubuntu 14.04. For a few weeks now a small window keeps popping up randomly, grabbing my keyboard and asking me to enter the passphrase for my ssh key. The Window's title says "OpenSSH", and it ...
3
votes
2answers
499 views

Updating PHP to Gaurd Against Mayhem Malware

How will making sure my PHP version is updated thwart the Mayhem Malware? Will updating PHP on my Ubuntu server prevent the Mayhem Malware from being able to make it onto the server, prevent it from ...
2
votes
2answers
95 views

Securely inspect email attachment

I received a really classic spam mail stating that I have to pay a bill. The mail included an attachment (.exe). Just for curiosity reasons: What would happen if I click on the attachment? (I am ...
1
vote
1answer
46 views

Scanning a file by multiply antiviruses

I start needing to scan for viruses all files uploaded to my website. I've implemented a pretty simple prototype which I tested locally and it seemed work well. However, I need to make it more complex ...
2
votes
3answers
130 views

How do I disable and re-enable Java whenever I want?

For me Java is just a security threat. Not many legitimate Linux apps use Java. However there is an abundance in Java malware and malicious remote administration tools like Jrat among others. But one ...
3
votes
3answers
221 views

Is there way to stop random software packages from remotely transferring your files?

I am running a bitcoin client on my archlinux computer. If somebody can get ahold of the wallet.dat file, located in the ~/.bitcoin/ directory they can steal my coins. I have minimal software ...
4
votes
2answers
1k views

Does this threat still exist: Linux keylogger without root privileges

http://superuser.com/questions/301646/linux-keylogger-without-root-or-sudo-is-it-real Or it's long gone as most of the new distros implement SELinux by default
1
vote
4answers
7k views

Do I really need an antivirus on Debian 7? [closed]

I use Debian 7 and I visit unknown and different websites. I want to know that people say that we get virus form internet and those virus hack our Bank accounts. Do I really need any antivirus? I ...
1
vote
1answer
212 views

Could Autorun Virus, affect my PC via Wine? [duplicate]

I have installed wine and I am afraid that viruses will affect my PC now. I will not open any other .exe file other than mine one (which I use everyday)
6
votes
1answer
955 views

how to make malware file readable with “No read permission on file” on linux ext-4?

There is an ongoing campaign of sending virus/trojans in e-mail messages faked as being from HSBC Bank, Lloyds TSB, Amazon etc. The trojan/virus is sent in a application/zip attachment. I've saved ...
9
votes
1answer
1k views

How to tell if mysterious programs in nethogs listing are malware?

This is what I see in Nethogs: I'm concerned about the listings with PID ?, running as root. How can I find out what these are? I'm running Linux Mint 14. Please let me know what other information ...
1
vote
0answers
486 views

maldet and possible false positives?

I have been using maldet for many months and it's worked fine up until now. As of about a week ago, it is detecting a mass {HEX}PHP.Bypassshell in nearly every PHP file. I even downloaded a clean copy ...
0
votes
1answer
65 views

Not able to copy original top command executable over a malicious one

Somebody hacked my system and replaced some of the system commands like top, ps, find etc with malicious ones. Now, I am trying to copy the original ones, but the copy or move commands fail, even ...
1
vote
0answers
243 views

How to enable on access scanning and the like in Debian Squeeze?

I am using Debian squeeze. I want to enable on access scanning and scanning of downloaded files and all options which are employed by a proprietary virus scanner for Windows on Linux. I am using ...
4
votes
4answers
213 views

Virus 'caught' while using Linux lays dormant, becomes active when login into Windows, can it be?

Can I 'catch' a Windows virus, while using Linux - so it will be saved on my hard drive and start working when I log in to Windows? I know it wouldn't affect the Linux itself. I am using 'Dual boot', ...
1
vote
3answers
163 views

Is it possible to have malware software in Linux without executing untrusted applications?

I'm linux user and I'm thinking about it's vulnerabilities to malware. Can I get any malware if I run only trusted applications from distro's repository?
3
votes
2answers
352 views

GNU/Linux distribution for network virus || malware identification

I'm looking for a GNU/Linux distro that I can install in transparent setup to look for infected hosts on a LAN. I don't need to stop viruses and malwares but only identify them and the host where they ...
1
vote
1answer
2k views

How to stop a windows virus run in Wine from infecting executables?

Yesterday all *.exe files on my machine were infected by Win32.Neshta virus after I ran one program via wine. I cured the machine with rm -rf ~/.wine, but it's no good anyway. So, I decided to set ...
1
vote
2answers
581 views

Deleting viruses from USB

When I use my USB drive on Windows computers, then return to my Linux computer, I find many extra files are added to the drive, often exe files and various folders. Is it sufficient to delete the ...