The tag has no usage guidance.

learn more… | top users | synonyms (1)

0
votes
1answer
134 views

Can I remove “Linux/Ebury Operation Windigo” without wiping the entire drive?

I used chkrootkit, which told me that I had "Linux/Ebury Operation Windigo" installed, I doubled checked by running ssh -G which printed out usage, without "illegal option". I removed all ssh files ...
1
vote
0answers
34 views

Theoric: How to kill a forever forking process?

Let's say you have a process that forks every time it has the chance. It launches itself in niceness -20, so it forks faster than you can kill it. Also, it remembers its childrens and it parents, so ...
1
vote
0answers
13 views

Spamassassin spam score and block configuration?

I've searched in the community and Google for this topic. There hasn't been a precise answer. I wanted to see the spam scores in the mail.log or syslog for Spamassassin running on my Linux server. It ...
0
votes
1answer
41 views

Suspicious traffic in nethogs on fresh install

Earlier today google said that unusual traffic was emanating from my computer and gave me a captcha. I got curious and installed nethogs. Everything appears normal except for an unknown program ...
0
votes
0answers
28 views

Practical method to safely use a USB stick on daily basis for Linux

Which practical method exist for safely using a USB stick on a daily basis, for Linux-based systems (e.g. Ubuntu) ? With emphasis over the following: I'm well aware that nothing is 100% secure ...
0
votes
1answer
72 views

replace long text string (script with MANY special characters). sed, awk, grep

My site was hacked / infected. I replaced the url of the malicious link, but other elements in the malicious script are still making my site get blocked. Without inserting a hundred or so "escapes", ...
1
vote
1answer
68 views

is my newly setup mail server on my laptop hacked?

I have just installed postfix on Arch Linux. I am following Arch wiki to set aliases to set following line in /etc/postfix/aliases root: edward after this I ran postalias /etc/postfix/aliases and ...
1
vote
0answers
46 views

Is the reader's linux '/usr/bin/mkdir' file larger than 53504 bytes? Has the reader got a virus?

I installed Fedora 19, and immediately listed the /usr/bin directory and saved the listing to a file. 4 hours later I list it again and all the executables have grown in size by about 1668 bytes. '...
0
votes
1answer
38 views

Does virus VBS Jenxcus affect Linux operating system? [closed]

Recently I connected to my linux a pendrive infected with VBS Jenxcus. Did it affect my operating system?
0
votes
6answers
334 views

Linux Mint: I'm infected with a rootkit

I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit ...
30
votes
8answers
2k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
1
vote
0answers
138 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
3
votes
3answers
182 views

Compromised server with malware “/usr/bin/fuck” and “/usr/bin/fake.cfg”

I am not asking what to do with an compromised box. Specifically, I am asking if anybody has experience with hack/malware amongst other files leaves files "/usr/bin/fake.cfg" and "/usr/bin/fuck". ...
0
votes
0answers
43 views

Junk Material on root crontab

I am investigating unexpected restart issue on my Oracle Unbreakable 6.5 and found some unexpected results on crontab for root users. I know that these are junk entries that my be cause to reboot ...
6
votes
1answer
1k views

how to make malware file readable with “No read permission on file” on linux ext-4?

There is an ongoing campaign of sending virus/trojans in e-mail messages faked as being from HSBC Bank, Lloyds TSB, Amazon etc. The trojan/virus is sent in a application/zip attachment. I've saved ...
0
votes
1answer
39 views

Steps to follow when you run untrusted program with elevated priviledges

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script. The script ran without asking for a password so I ...
4
votes
2answers
1k views

Does this threat still exist: Linux keylogger without root privileges

http://superuser.com/questions/301646/linux-keylogger-without-root-or-sudo-is-it-real Or it's long gone as most of the new distros implement SELinux by default
21
votes
5answers
3k views

Does installing and using Wine open up your Linux platform to Windows viruses?

Just wondering if installing Wine might open up a fairly solid Linux desktop to the world of Windows viruses. Any confirmed reports about that? Would you then install a Windows antivirus product ...
0
votes
2answers
223 views

How to remove a script tag from a text file with sed

I have a number of header.php files that have a malicious script tag contained within them (don't ask). I've written a not-so-elegant shell script to replace these with blank space. I had initially ...
15
votes
4answers
6k views

How to detect and remove a Linux trojan?

I recently (re)stumbled upon this: Linux Trojan Goes Unnoticed For Almost A Year (Unreal IRCd) Yes, I know that adding some random PPA/software from an untrusted source is asking for trouble (or ...
124
votes
9answers
13k views

The myths about malware in Unix / Linux

Is it possible for my Linux box to become infected with a malware? I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true? If so, ...
-2
votes
1answer
51 views

ClamAV installation problem?

My USB has windows viruses in it. Before attaching it to device(windows installed), I want to delete these viruses but i have kali installed device also from which I want this action to be done. I got ...
0
votes
1answer
69 views

Detect Viruses in USB?

My USB pen brings often Windows Viruses in it. Before attaching it to windows again I would prefer to delete viruses. I have Kali Linux. Is there any way to detect Windows viruses/threats through ...
3
votes
1answer
102 views

Oracle's VirtualBox and keyloggers

So, I have installed Windows 7 in Oracle's VirtualBox (5.0.8) and I would like to know if the Windows 7 software (including viruses and malware) is able in the default VirtualBox settings access the ...
0
votes
1answer
196 views

Files getting reverted to older version

One of my site was infested with malware once and since then I am seeing every alternate day the header.php files are getting reverted back to older versions (possibly by a script) and a malicious ...
3
votes
2answers
1k views

Web server infected by backdoor Trojan, how to fix?

Recently, my linux server sends a very large file (10mb-10G/s outside at certain times, but I can't figure out what is the cause. Here is the screen shot i use clamav to scan all files and got the ...
1
vote
1answer
52 views

Thoughts on security in linux [closed]

So ransomware is around again - at least in Denmark. This is a major issue for MS-Windows users, but does almost never affect Linux or Mac. The reason is an issue of debate. But since the consumer ...
0
votes
1answer
56 views

How to know which computer is trying to access a specific host

At my workplace we tend to get those annoying captchas once in a while when we are trying for search something in Google. When we got into that page it says that our network is trying to access ...
1
vote
1answer
59 views

Linux and being black listed

I have some experience with Linux, currently running Ubuntu 14.04.2 LTS. I've disabled (a long time ago) root login - via ssh or webmin. I've changed my tomcat's username (good luck to the f**kers ...
2
votes
0answers
38 views

How often are user repositories abused? [closed]

No matter which distribution you use, you probably have a package manager and most likely installed one or two packages from an "unofficial source", meaning a regular user has provided it. As ...
2
votes
1answer
447 views

Exploit FOUND with clamav on Fedora 21 in Oracle's java

I'm scanning one of my systems with Clamav like this: $ clamscan -r -i --remove --max-filesize=4000M --max-scansize=4000M \ --exclude=/proc --exclude=/sys --exclude=/dev --bytecode-timeout=...
0
votes
2answers
69 views

Is this an argument that Linux security is not impenetrable?

From what I understand, the biggest and probably only line of defense against unauthorized software (viruses and worms) from being installed on the system is to simply not allow it unless an admin ...
-2
votes
3answers
85 views

Is linux secure? [duplicate]

Is linux free from almost all security vulnerabilities when compared with windows? If there are so, can i install any patches to fix them? Thanks in advance.
0
votes
0answers
133 views

Errors when installing Maldet on an Fedora 20 system, have had these before

I just installed maldetect-1.4.2 on a system(Fedora 20) and it gives this error when installing: gzip: stdin: unexpected end of file tar: Child returned status 1 tar: Error is not recoverable:...
1
vote
2answers
268 views

How can I do a virus scan on a Linux CD or ISO from windows?

I am going to try some Linux live CDs made by individuals. I want to make sure that it doesn't contain malware. How do I do it?
1
vote
1answer
103 views

unix system with malware

I have a CENTOS server that is infected with malware: top shows there's an unknown process that's consuming all the CPUs, if you kill it, it respawns with a different name. what's the best way to ...
0
votes
3answers
498 views

Unknown cause for redirect on 80 port

I have an Ubuntu 14.04 server with Apache 2.4.7 running there, hosting one site on 80 port. Today I discovered that every request to 80 port redirects to another website with response: HTTP/1.1 301 ...
2
votes
3answers
593 views

find who sends spam

I have a LAMP Ubuntu 10.04 server. There are many (>140) users and a lot of different web PHP sites (custom, different PHP frameworks, CMS etc). The problem is: sometimes the server sends "spam". And ...
4
votes
1answer
277 views

Tons of unknown connections in nethogs

I am seeing hundreds of different connections to the same ip and port scrolling by when running nethogs. Occasionally the foreign IP and port will change (not always 80, but sometimes). I've noticed ...
2
votes
1answer
492 views

A window asking me to enter my ssh passphrase is popping up randomly. Why?

I'm on Ubuntu 14.04. For a few weeks now a small window keeps popping up randomly, grabbing my keyboard and asking me to enter the passphrase for my ssh key. The Window's title says "OpenSSH", and it ...
1
vote
3answers
50 views

Is RPM able to control the files in home folder without confirmation?

RPM extension file can be run by double clicking no matter what's inside the package, and then it asks for the root password in order to install something to your system, but if I don't give it, will ...
5
votes
3answers
1k views

Shellshock: Why this error when testing for vulnerability

I am using Fedora 20 on two machines. Having read about the Shellshock vulnerability, just now at 1100ish UTC on September 26th 2014, in UK, after a yum update bash to protect against it, I tried ...
3
votes
2answers
475 views

Is there any Virus attack in Linux?

Is there any virus attack on any of the current distributions of Linux? if there is any, how was it solved? have they used any anti virus programs which are available now?
7
votes
3answers
370 views

Should I install an antivirus?

Are builtin security features allied to secure user behavior enough to protect a Linux system? Or should I install an antivirus software?
2
votes
0answers
353 views

API Monitoring and Hooking

I am currently reading the "Malware Analyst's Cookbook and DVD". There is a chapter "Dynamic Analysis" and there are also some recipes about hooking and monitoring API calls of process but it is for ...
2
votes
0answers
679 views

How do I stop the “Green double-underlined links pop-up ads” adware in Chromium? [closed]

Summary: In the Chromium web browser (Debian), can you tell me how get rid of whatever is causing the behaviour called "Green Double-Underlined Links pop-up ads"? I'd like to stop the behaviour, not ...
1
vote
1answer
126 views

What is the exact function of this malicious bash one-liner?

I can't figure out what this is trying to do. The part between backticks looks like a plain old forkbomb, but the base64 doesn't seem to decode to anything sensible. Can you help? Don't run it, ...
3
votes
2answers
522 views

Updating PHP to Gaurd Against Mayhem Malware

How will making sure my PHP version is updated thwart the Mayhem Malware? Will updating PHP on my Ubuntu server prevent the Mayhem Malware from being able to make it onto the server, prevent it from ...
9
votes
1answer
1k views

How to tell if mysterious programs in nethogs listing are malware?

This is what I see in Nethogs: I'm concerned about the listings with PID ?, running as root. How can I find out what these are? I'm running Linux Mint 14. Please let me know what other information ...
2
votes
2answers
135 views

Securely inspect email attachment

I received a really classic spam mail stating that I have to pay a bill. The mail included an attachment (.exe). Just for curiosity reasons: What would happen if I click on the attachment? (I am ...