The tag has no usage guidance.

learn more… | top users | synonyms (1)

122
votes
9answers
13k views

The myths about malware in Unix / Linux

Is it possible for my Linux box to become infected with a malware? I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true? If so, ...
30
votes
8answers
2k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
21
votes
5answers
3k views

Does installing and using Wine open up your Linux platform to Windows viruses?

Just wondering if installing Wine might open up a fairly solid Linux desktop to the world of Windows viruses. Any confirmed reports about that? Would you then install a Windows antivirus product ...
15
votes
4answers
6k views

How to detect and remove a Linux trojan?

I recently (re)stumbled upon this: Linux Trojan Goes Unnoticed For Almost A Year (Unreal IRCd) Yes, I know that adding some random PPA/software from an untrusted source is asking for trouble (or ...
9
votes
1answer
1k views

How to tell if mysterious programs in nethogs listing are malware?

This is what I see in Nethogs: I'm concerned about the listings with PID ?, running as root. How can I find out what these are? I'm running Linux Mint 14. Please let me know what other information ...
7
votes
2answers
397 views

Can I get infected in this case if I run a live cd?

I recently got rid of a nasty trojan on Windows and want to migrate to Linux(Ubuntu). I want to run a Live CD so that I can format an SD card to put my brand new firmware on my router and format the ...
7
votes
3answers
370 views

Should I install an antivirus?

Are builtin security features allied to secure user behavior enough to protect a Linux system? Or should I install an antivirus software?
6
votes
2answers
1k views

Java problem - nearly looks like a virus?

I have a weird problem since about a week. When I wake up my computer from suspend, a java process starts and consumes about 170 % CPU capacity. I analyzed the java process a bit: it connects to ...
6
votes
1answer
1k views

how to make malware file readable with “No read permission on file” on linux ext-4?

There is an ongoing campaign of sending virus/trojans in e-mail messages faked as being from HSBC Bank, Lloyds TSB, Amazon etc. The trojan/virus is sent in a application/zip attachment. I've saved ...
5
votes
3answers
1k views

Shellshock: Why this error when testing for vulnerability

I am using Fedora 20 on two machines. Having read about the Shellshock vulnerability, just now at 1100ish UTC on September 26th 2014, in UK, after a yum update bash to protect against it, I tried ...
4
votes
4answers
217 views

Virus 'caught' while using Linux lays dormant, becomes active when login into Windows, can it be?

Can I 'catch' a Windows virus, while using Linux - so it will be saved on my hard drive and start working when I log in to Windows? I know it wouldn't affect the Linux itself. I am using 'Dual boot', ...
4
votes
2answers
1k views

Does this threat still exist: Linux keylogger without root privileges

http://superuser.com/questions/301646/linux-keylogger-without-root-or-sudo-is-it-real Or it's long gone as most of the new distros implement SELinux by default
4
votes
1answer
274 views

Tons of unknown connections in nethogs

I am seeing hundreds of different connections to the same ip and port scrolling by when running nethogs. Occasionally the foreign IP and port will change (not always 80, but sometimes). I've noticed ...
3
votes
3answers
226 views

Is there way to stop random software packages from remotely transferring your files?

I am running a bitcoin client on my archlinux computer. If somebody can get ahold of the wallet.dat file, located in the ~/.bitcoin/ directory they can steal my coins. I have minimal software ...
3
votes
3answers
180 views

Compromised server with malware “/usr/bin/fuck” and “/usr/bin/fake.cfg”

I am not asking what to do with an compromised box. Specifically, I am asking if anybody has experience with hack/malware amongst other files leaves files "/usr/bin/fake.cfg" and "/usr/bin/fuck". ...
3
votes
2answers
1k views

Web server infected by backdoor Trojan, how to fix?

Recently, my linux server sends a very large file (10mb-10G/s outside at certain times, but I can't figure out what is the cause. Here is the screen shot i use clamav to scan all files and got the ...
3
votes
2answers
522 views

Updating PHP to Gaurd Against Mayhem Malware

How will making sure my PHP version is updated thwart the Mayhem Malware? Will updating PHP on my Ubuntu server prevent the Mayhem Malware from being able to make it onto the server, prevent it from ...
3
votes
2answers
474 views

Is there any Virus attack in Linux?

Is there any virus attack on any of the current distributions of Linux? if there is any, how was it solved? have they used any anti virus programs which are available now?
3
votes
1answer
102 views

Oracle's VirtualBox and keyloggers

So, I have installed Windows 7 in Oracle's VirtualBox (5.0.8) and I would like to know if the Windows 7 software (including viruses and malware) is able in the default VirtualBox settings access the ...
3
votes
2answers
357 views

GNU/Linux distribution for network virus || malware identification

I'm looking for a GNU/Linux distro that I can install in transparent setup to look for infected hosts on a LAN. I don't need to stop viruses and malwares but only identify them and the host where they ...
2
votes
1answer
446 views

Exploit FOUND with clamav on Fedora 21 in Oracle's java

I'm scanning one of my systems with Clamav like this: $ clamscan -r -i --remove --max-filesize=4000M --max-scansize=4000M \ --exclude=/proc --exclude=/sys --exclude=/dev --bytecode-timeout=...
2
votes
3answers
132 views

How do I disable and re-enable Java whenever I want?

For me Java is just a security threat. Not many legitimate Linux apps use Java. However there is an abundance in Java malware and malicious remote administration tools like Jrat among others. But one ...
2
votes
3answers
588 views

find who sends spam

I have a LAMP Ubuntu 10.04 server. There are many (>140) users and a lot of different web PHP sites (custom, different PHP frameworks, CMS etc). The problem is: sometimes the server sends "spam". And ...
2
votes
2answers
135 views

Securely inspect email attachment

I received a really classic spam mail stating that I have to pay a bill. The mail included an attachment (.exe). Just for curiosity reasons: What would happen if I click on the attachment? (I am ...
2
votes
0answers
38 views

How often are user repositories abused? [closed]

No matter which distribution you use, you probably have a package manager and most likely installed one or two packages from an "unofficial source", meaning a regular user has provided it. As ...
2
votes
0answers
352 views

API Monitoring and Hooking

I am currently reading the "Malware Analyst's Cookbook and DVD". There is a chapter "Dynamic Analysis" and there are also some recipes about hooking and monitoring API calls of process but it is for ...
2
votes
0answers
679 views

How do I stop the “Green double-underlined links pop-up ads” adware in Chromium? [closed]

Summary: In the Chromium web browser (Debian), can you tell me how get rid of whatever is causing the behaviour called "Green Double-Underlined Links pop-up ads"? I'd like to stop the behaviour, not ...
2
votes
1answer
490 views

A window asking me to enter my ssh passphrase is popping up randomly. Why?

I'm on Ubuntu 14.04. For a few weeks now a small window keeps popping up randomly, grabbing my keyboard and asking me to enter the passphrase for my ssh key. The Window's title says "OpenSSH", and it ...
1
vote
4answers
8k views

Do I really need an antivirus on Debian 7? [closed]

I use Debian 7 and I visit unknown and different websites. I want to know that people say that we get virus form internet and those virus hack our Bank accounts. Do I really need any antivirus? I ...
1
vote
2answers
672 views

Deleting viruses from USB

When I use my USB drive on Windows computers, then return to my Linux computer, I find many extra files are added to the drive, often exe files and various folders. Is it sufficient to delete the ...
1
vote
3answers
50 views

Is RPM able to control the files in home folder without confirmation?

RPM extension file can be run by double clicking no matter what's inside the package, and then it asks for the root password in order to install something to your system, but if I don't give it, will ...
1
vote
1answer
103 views

unix system with malware

I have a CENTOS server that is infected with malware: top shows there's an unknown process that's consuming all the CPUs, if you kill it, it respawns with a different name. what's the best way to ...
1
vote
1answer
46 views

Scanning a file by multiply antiviruses

I start needing to scan for viruses all files uploaded to my website. I've implemented a pretty simple prototype which I tested locally and it seemed work well. However, I need to make it more complex ...
1
vote
2answers
283 views

Is Linux really malware safe? Or people just don't bother creating them for Linux? [duplicate]

Possible Duplicate: The myths about viruses in unix/linux I've never used Linux before and I heard that you don't need to worry about malware on Linux. So, as the title said, is Linux really ...
1
vote
2answers
267 views

How can I do a virus scan on a Linux CD or ISO from windows?

I am going to try some Linux live CDs made by individuals. I want to make sure that it doesn't contain malware. How do I do it?
1
vote
1answer
126 views

What is the exact function of this malicious bash one-liner?

I can't figure out what this is trying to do. The part between backticks looks like a plain old forkbomb, but the base64 doesn't seem to decode to anything sensible. Can you help? Don't run it, ...
1
vote
3answers
167 views

Is it possible to have malware software in Linux without executing untrusted applications?

I'm linux user and I'm thinking about it's vulnerabilities to malware. Can I get any malware if I run only trusted applications from distro's repository?
1
vote
1answer
1k views

How to find out that someone is using a Keylogger on the machine I am using?

HW/SW/whatever keyloggers are there. How to find out? E.x.: Regularly check the cable of the keyboard, because there could be HW keyloggers: http://i.imgur.com/TeMwo.jpg But what about other HW ...
1
vote
1answer
52 views

Thoughts on security in linux [closed]

So ransomware is around again - at least in Denmark. This is a major issue for MS-Windows users, but does almost never affect Linux or Mac. The reason is an issue of debate. But since the consumer ...
1
vote
1answer
59 views

Linux and being black listed

I have some experience with Linux, currently running Ubuntu 14.04.2 LTS. I've disabled (a long time ago) root login - via ssh or webmin. I've changed my tomcat's username (good luck to the f**kers ...
1
vote
1answer
232 views

Could Autorun Virus, affect my PC via Wine? [duplicate]

I have installed wine and I am afraid that viruses will affect my PC now. I will not open any other .exe file other than mine one (which I use everyday)
1
vote
1answer
2k views

How to stop a windows virus run in Wine from infecting executables?

Yesterday all *.exe files on my machine were infected by Win32.Neshta virus after I ran one program via wine. I cured the machine with rm -rf ~/.wine, but it's no good anyway. So, I decided to set ...
1
vote
0answers
33 views

Theoric: How to kill a forever forking process?

Let's say you have a process that forks every time it has the chance. It launches itself in niceness -20, so it forks faster than you can kill it. Also, it remembers its childrens and it parents, so ...
1
vote
0answers
13 views

Spamassassin spam score and block configuration?

I've searched in the community and Google for this topic. There hasn't been a precise answer. I wanted to see the spam scores in the mail.log or syslog for Spamassassin running on my Linux server. It ...
1
vote
1answer
68 views

is my newly setup mail server on my laptop hacked?

I have just installed postfix on Arch Linux. I am following Arch wiki to set aliases to set following line in /etc/postfix/aliases root: edward after this I ran postalias /etc/postfix/aliases and ...
1
vote
0answers
46 views

Is the reader's linux '/usr/bin/mkdir' file larger than 53504 bytes? Has the reader got a virus?

I installed Fedora 19, and immediately listed the /usr/bin directory and saved the listing to a file. 4 hours later I list it again and all the executables have grown in size by about 1668 bytes. '...
1
vote
0answers
137 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
1
vote
0answers
525 views

maldet and possible false positives?

I have been using maldet for many months and it's worked fine up until now. As of about a week ago, it is detecting a mass {HEX}PHP.Bypassshell in nearly every PHP file. I even downloaded a clean copy ...
0
votes
2answers
354 views

FreeBSD's kernel is 'locked'?

I happened to talk to a Mac Genius on the subject of viruses. He mentioned that the FreeBSD kernel on which the Mac OS is based is 'locked' and therefore no viruses can ever harm my Mac. I didn't ...
0
votes
6answers
327 views

Linux Mint: I'm infected with a rootkit

I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit ...