The tag has no usage guidance.

learn more… | top users | synonyms (1)

1
vote
1answer
53 views

is my newly setup mail server on my laptop hacked?

I have just installed postfix on Arch Linux. I am following Arch wiki to set aliases to set following line in /etc/postfix/aliases root: edward after this I ran postalias /etc/postfix/aliases and ...
1
vote
0answers
44 views

Is the reader's linux '/usr/bin/mkdir' file larger than 53504 bytes? Has the reader got a virus?

I installed Fedora 19, and immediately listed the /usr/bin directory and saved the listing to a file. 4 hours later I list it again and all the executables have grown in size by about 1668 bytes. ...
0
votes
1answer
30 views

Does virus VBS Jenxcus affect Linux operating system? [closed]

Recently I connected to my linux a pendrive infected with VBS Jenxcus. Did it affect my operating system?
0
votes
0answers
56 views

Can I remove “Linux/Ebury Operation Windigo” without wiping the entire drive?

I used chkrootkit, which told me that I had "Linux/Ebury Operation Windigo" installed, I doubled checked by running ssh -G which printed out usage, without "illegal option". I removed all ssh files ...
0
votes
6answers
192 views

Linux Mint: I'm infected with a rootkit

I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit ...
30
votes
8answers
2k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
1
vote
0answers
127 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
0
votes
0answers
37 views

Junk Material on root crontab

I am investigating unexpected restart issue on my Oracle Unbreakable 6.5 and found some unexpected results on crontab for root users. I know that these are junk entries that my be cause to reboot ...
0
votes
1answer
55 views

replace long text string (script with MANY special characters). sed, awk, grep

My site was hacked / infected. I replaced the url of the malicious link, but other elements in the malicious script are still making my site get blocked. Without inserting a hundred or so "escapes", ...
0
votes
1answer
35 views

Steps to follow when you run untrusted program with elevated priviledges

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script. The script ran without asking for a password so I ...
3
votes
3answers
141 views

Compromised server with malware “/usr/bin/fuck” and “/usr/bin/fake.cfg”

I am not asking what to do with an compromised box. Specifically, I am asking if anybody has experience with hack/malware amongst other files leaves files "/usr/bin/fake.cfg" and "/usr/bin/fuck". ...
0
votes
2answers
191 views

How to remove a script tag from a text file with sed

I have a number of header.php files that have a malicious script tag contained within them (don't ask). I've written a not-so-elegant shell script to replace these with blank space. I had initially ...
-2
votes
1answer
42 views

ClamAV installation problem?

My USB has windows viruses in it. Before attaching it to device(windows installed), I want to delete these viruses but i have kali installed device also from which I want this action to be done. I got ...
0
votes
1answer
67 views

Detect Viruses in USB?

My USB pen brings often Windows Viruses in it. Before attaching it to windows again I would prefer to delete viruses. I have Kali Linux. Is there any way to detect Windows viruses/threats through ...
3
votes
1answer
85 views

Oracle's VirtualBox and keyloggers

So, I have installed Windows 7 in Oracle's VirtualBox (5.0.8) and I would like to know if the Windows 7 software (including viruses and malware) is able in the default VirtualBox settings access the ...
0
votes
1answer
193 views

Files getting reverted to older version

One of my site was infested with malware once and since then I am seeing every alternate day the header.php files are getting reverted back to older versions (possibly by a script) and a malicious ...
1
vote
1answer
51 views

Thoughts on security in linux [closed]

So ransomware is around again - at least in Denmark. This is a major issue for MS-Windows users, but does almost never affect Linux or Mac. The reason is an issue of debate. But since the consumer ...
2
votes
2answers
1k views

Web server infected by backdoor Trojan, how to fix?

Recently, my linux server sends a very large file (10mb-10G/s outside at certain times, but I can't figure out what is the cause. Here is the screen shot i use clamav to scan all files and got the ...
1
vote
1answer
56 views

Linux and being black listed

I have some experience with Linux, currently running Ubuntu 14.04.2 LTS. I've disabled (a long time ago) root login - via ssh or webmin. I've changed my tomcat's username (good luck to the f**kers ...
0
votes
1answer
53 views

How to know which computer is trying to access a specific host

At my workplace we tend to get those annoying captchas once in a while when we are trying for search something in Google. When we got into that page it says that our network is trying to access ...
2
votes
0answers
37 views

How often are user repositories abused? [closed]

No matter which distribution you use, you probably have a package manager and most likely installed one or two packages from an "unofficial source", meaning a regular user has provided it. As ...
2
votes
1answer
413 views

Exploit FOUND with clamav on Fedora 21 in Oracle's java

I'm scanning one of my systems with Clamav like this: $ clamscan -r -i --remove --max-filesize=4000M --max-scansize=4000M \ --exclude=/proc --exclude=/sys --exclude=/dev ...
0
votes
2answers
66 views

Is this an argument that Linux security is not impenetrable?

From what I understand, the biggest and probably only line of defense against unauthorized software (viruses and worms) from being installed on the system is to simply not allow it unless an admin ...
-2
votes
3answers
82 views

Is linux secure? [duplicate]

Is linux free from almost all security vulnerabilities when compared with windows? If there are so, can i install any patches to fix them? Thanks in advance.
0
votes
0answers
126 views

Errors when installing Maldet on an Fedora 20 system, have had these before

I just installed maldetect-1.4.2 on a system(Fedora 20) and it gives this error when installing: gzip: stdin: unexpected end of file tar: Child returned status 1 tar: Error is not ...
1
vote
2answers
237 views

How can I do a virus scan on a Linux CD or ISO from windows?

I am going to try some Linux live CDs made by individuals. I want to make sure that it doesn't contain malware. How do I do it?
1
vote
1answer
100 views

unix system with malware

I have a CENTOS server that is infected with malware: top shows there's an unknown process that's consuming all the CPUs, if you kill it, it respawns with a different name. what's the best way to ...
0
votes
3answers
460 views

Unknown cause for redirect on 80 port

I have an Ubuntu 14.04 server with Apache 2.4.7 running there, hosting one site on 80 port. Today I discovered that every request to 80 port redirects to another website with response: HTTP/1.1 301 ...
2
votes
3answers
517 views

find who sends spam

I have a LAMP Ubuntu 10.04 server. There are many (>140) users and a lot of different web PHP sites (custom, different PHP frameworks, CMS etc). The problem is: sometimes the server sends "spam". And ...
1
vote
3answers
44 views

Is RPM able to control the files in home folder without confirmation?

RPM extension file can be run by double clicking no matter what's inside the package, and then it asks for the root password in order to install something to your system, but if I don't give it, will ...
3
votes
1answer
257 views

Tons of unknown connections in nethogs

I am seeing hundreds of different connections to the same ip and port scrolling by when running nethogs. Occasionally the foreign IP and port will change (not always 80, but sometimes). I've noticed ...
5
votes
3answers
1k views

Shellshock: Why this error when testing for vulnerability

I am using Fedora 20 on two machines. Having read about the Shellshock vulnerability, just now at 1100ish UTC on September 26th 2014, in UK, after a yum update bash to protect against it, I tried ...
2
votes
0answers
299 views

API Monitoring and Hooking

I am currently reading the "Malware Analyst's Cookbook and DVD". There is a chapter "Dynamic Analysis" and there are also some recipes about hooking and monitoring API calls of process but it is for ...
2
votes
0answers
661 views

How do I stop the “Green double-underlined links pop-up ads” adware in Chromium?

Summary: In the Chromium web browser (Debian), can you tell me how get rid of whatever is causing the behaviour called "Green Double-Underlined Links pop-up ads"? I'd like to stop the behaviour, not ...
1
vote
1answer
114 views

What is the exact function of this malicious bash one-liner?

I can't figure out what this is trying to do. The part between backticks looks like a plain old forkbomb, but the base64 doesn't seem to decode to anything sensible. Can you help? Don't run it, ...
2
votes
1answer
449 views

A window asking me to enter my ssh passphrase is popping up randomly. Why?

I'm on Ubuntu 14.04. For a few weeks now a small window keeps popping up randomly, grabbing my keyboard and asking me to enter the passphrase for my ssh key. The Window's title says "OpenSSH", and it ...
3
votes
2answers
514 views

Updating PHP to Gaurd Against Mayhem Malware

How will making sure my PHP version is updated thwart the Mayhem Malware? Will updating PHP on my Ubuntu server prevent the Mayhem Malware from being able to make it onto the server, prevent it from ...
2
votes
2answers
119 views

Securely inspect email attachment

I received a really classic spam mail stating that I have to pay a bill. The mail included an attachment (.exe). Just for curiosity reasons: What would happen if I click on the attachment? (I am ...
1
vote
1answer
46 views

Scanning a file by multiply antiviruses

I start needing to scan for viruses all files uploaded to my website. I've implemented a pretty simple prototype which I tested locally and it seemed work well. However, I need to make it more complex ...
2
votes
3answers
131 views

How do I disable and re-enable Java whenever I want?

For me Java is just a security threat. Not many legitimate Linux apps use Java. However there is an abundance in Java malware and malicious remote administration tools like Jrat among others. But one ...
3
votes
3answers
223 views

Is there way to stop random software packages from remotely transferring your files?

I am running a bitcoin client on my archlinux computer. If somebody can get ahold of the wallet.dat file, located in the ~/.bitcoin/ directory they can steal my coins. I have minimal software ...
4
votes
2answers
1k views

Does this threat still exist: Linux keylogger without root privileges

http://superuser.com/questions/301646/linux-keylogger-without-root-or-sudo-is-it-real Or it's long gone as most of the new distros implement SELinux by default
1
vote
4answers
7k views

Do I really need an antivirus on Debian 7? [closed]

I use Debian 7 and I visit unknown and different websites. I want to know that people say that we get virus form internet and those virus hack our Bank accounts. Do I really need any antivirus? I ...
1
vote
1answer
229 views

Could Autorun Virus, affect my PC via Wine? [duplicate]

I have installed wine and I am afraid that viruses will affect my PC now. I will not open any other .exe file other than mine one (which I use everyday)
6
votes
1answer
1k views

how to make malware file readable with “No read permission on file” on linux ext-4?

There is an ongoing campaign of sending virus/trojans in e-mail messages faked as being from HSBC Bank, Lloyds TSB, Amazon etc. The trojan/virus is sent in a application/zip attachment. I've saved ...
9
votes
1answer
1k views

How to tell if mysterious programs in nethogs listing are malware?

This is what I see in Nethogs: I'm concerned about the listings with PID ?, running as root. How can I find out what these are? I'm running Linux Mint 14. Please let me know what other information ...
1
vote
0answers
515 views

maldet and possible false positives?

I have been using maldet for many months and it's worked fine up until now. As of about a week ago, it is detecting a mass {HEX}PHP.Bypassshell in nearly every PHP file. I even downloaded a clean copy ...
0
votes
1answer
68 views

Not able to copy original top command executable over a malicious one

Somebody hacked my system and replaced some of the system commands like top, ps, find etc with malicious ones. Now, I am trying to copy the original ones, but the copy or move commands fail, even ...
1
vote
0answers
255 views

How to enable on access scanning and the like in Debian Squeeze?

I am using Debian squeeze. I want to enable on access scanning and scanning of downloaded files and all options which are employed by a proprietary virus scanner for Windows on Linux. I am using ...
4
votes
4answers
217 views

Virus 'caught' while using Linux lays dormant, becomes active when login into Windows, can it be?

Can I 'catch' a Windows virus, while using Linux - so it will be saved on my hard drive and start working when I log in to Windows? I know it wouldn't affect the Linux itself. I am using 'Dual boot', ...