Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

0
votes
2answers
37 views

Unwanted emails are sent from some exchange users

In our exchange environment some unwanted emails are sent from a few users to abnormal addresses with .xyz suffix.They stuck in queue as the destination server isn't available. Affected users got ...
6
votes
4answers
486 views

Is this is a malware invocation of Powershell?

I got a file that was .avi at the fist glance, but then I found out that in fact this is a .lnk file, but it was too late. And the target element attribute of that file is C:\Windows\System32\...
1
vote
2answers
85 views

How to determine process which makes DNS Request? [duplicate]

I have a server on AWS, GuardDuty started send me notifications: *** "type":"Backdoor:EC2/C&CActivity.B!DNS", *** {"domain":"libcurl.so","protocol":"UDP","blocked":false} *** is querying a domain ...
0
votes
0answers
12 views

How to locate and remove Coin-hive Javascript Miner from local network [duplicate]

In my office i currently have a problem with Coin-hive javascript miner Trojan that shows up on internet browsers on every PC (6 pc's in local network). I followed the steps on internet and tips for ...
0
votes
1answer
38 views

Process without name [duplicate]

I have a web server, due to an outdated Wordpress some hacker uploaded a webshell. Throught it, he launched a process but the ps command is not showing any name for the process: root@serv ~ # ps aux|...
0
votes
0answers
20 views

Malicious Index.php files to remove or not to remove [duplicate]

My wordpress website was hacked badly. I need some help if it is possible. I noticed that serveral index.php files (around 10 index.php files) in my website was modified. All the codes inside the php ...
1
vote
1answer
54 views

Why does my “ps aux” command column now show gibberish?

While using ps aux to find the PID of a process, I came across some output that prevented me from doing so. I've done this before, on this same server, within the last month. Today's output looked ...
0
votes
1answer
36 views

Windows Server 2011 - System opening ominous TCP connections

Where I work we have a Windows Server 2011 Small Business edition, and recently our Symantec software started reporting "blocked intrusion attempts" from port 80. Our routers do not forward any port ...
0
votes
0answers
12 views

How to remove Annizod and milemined on debian 8? [duplicate]

i noticed with top command that thare were two processes on called "annizod" the other one "milemined", a quick search on Google, they seem to be malware. I'd like to remove them and know which ...
0
votes
0answers
16 views

Getting rid of wordpress malware from DigitalOcean droplet [duplicate]

I host 10 wordpress websites and several non-WP too on my DigitalOcean droplet. Around 4 weeks ago I started noticing strange files all over my droplet, like jsdgsh.php. I installed Wordfence plugin ...
0
votes
1answer
36 views

Where does O365 track end user clicks on SafeLinks?

O365 SafeLinks policy has a setting to disable the per-user clicks of URLs in an email message. I want to obtain a report of potentially infected desktops where the user clicked on the URL and either ...
0
votes
0answers
52 views

What are these ClamAV cPanel alerts? Are they real threats? [duplicate]

I just ran a complete ClamAV scan of a cPanel users files and detected a small number of potential real alerts and a large number of alerts in my mail folder. I'm looking for help determining primary ...
0
votes
2answers
53 views

Can I tell whether or not an internal user opened an email attachment?

We run Exchange 2010/Outlook 2013, and today a number of our users received an email with an attachment that contained malware. Our current anti-malware product didn't detect the malware, but I found ...
0
votes
1answer
42 views

HKCU Sotware In Registry & Malware

In reading about forensics its mentioned that malware could be found in the Software HKCU. My question is if malware installs will Windows definitely put it in this registry section? I always assumed ...
0
votes
0answers
85 views

I think I just found the encryption key used by ransomware on my server… how can I check?

Long story short, server ended up with a ton of encrypted files. IDRansomware thinks it was GlobeImposter 2.0, see here. I'm not 100% sure on that as I ended up with a ..rtf file extension on my ...
0
votes
0answers
159 views

Windows server 2016 - There are many files named by chinese characters in C:\Windows\System32\LogFiles\Sum

As the title. I installed windows server 2016 on my server with language setting is English-US as default. Have never changed language settings However I found this Is computer infected a virus?
0
votes
0answers
8 views

centos - malware repeat a command and make high CPU usage [duplicate]

my Centos server fail on Ddos attack and i fix it by blocking some IP but now always i have a high CPU usage. htop command show me a simple command like "ls", "cd", "gnome-terminal" and etc.. make ...
0
votes
0answers
25 views

Malware or False Positive? {YARA}eval_post : [duplicate]

I ran a server scan and got the hits with {YARA}eval_post : Are these false positives? {YARA}eval_post : /home/nyhypnos/logs/miamihypnosisnow.nyhypnosisinstitute.com-Mar-2018.gz {YARA}eval_post : /...
0
votes
1answer
59 views

Win10 PCs trying to connect to file shares on 10.10.10.1 for unknown reason

I'm routinely going through our firewall logs, and recently I noticed that a lot of our Windows 10 clients are trying to open file shares (or otherwise connect to tcp/445) on the IP 10.10.10.1. Since ...
0
votes
0answers
11 views

PHP - track probably malicious php script [duplicate]

I have Xenforo installation in home directory: /home/myaccount/public_html/forum Lastly, i have read in logs that every 5 minutes command /usr/bin/php /home/myaccount/public_html/forum/index.php ...
0
votes
0answers
67 views

SSH Suspicious Commands on Hosting Server

I have a dedicated hosting server that is hosting few websites. I recently accessed my server thru Terminal command line and noticed that the last few commands that were executed weren't from me - ...
0
votes
0answers
14 views

Suspicious services during start on Ubuntu server 16.04.1 LTS [duplicate]

Not a [Duplicate] My 2Mbit internet disappeared (stopped loaing anything), while DNS was successfully resolving and pings were normal to anywhere. No ping loss. This looked as if the bandwidth has ...
0
votes
2answers
189 views

centos 7 high outbound traffic 50-80 MiB/s, trouble identifying process

I have an updated fresh install of CentOS 7. A day after installing I noticed a ton of outbound traffic coming from it, enough to slow the whole home network down and crash my Netgear n450 router. ...
0
votes
1answer
51 views

protect NAS shared folder against cryptolocker attack

I got a NAS with some shared folders, for access it a user/pass authentication is needed. My question is about how a malicious software (expecially a cryptolocker) can access to the network folder ...
0
votes
0answers
16 views

Miner bot taking up CPU on old server [duplicate]

I've been asked to take a look at an old web server (Ubuntu 12.04) which has been running very slow recently. After a quick check I found a process constantly topping the cpu: PID USER PR NI ...
1
vote
0answers
40 views

How to get rid of adfly javascript code to be inserted automatically in my web pages

in my website, adfly's javascript code is inserted automatically after every few hours in index.php and default.php web pages. Every time I remove these unwanted code from both pages manually and that ...
0
votes
0answers
132 views

Ubuntu fetching packages from sketchy IPs — 151.205.24.17 and 151.205.24.19

I first noticed this when attempting to set up docker. I set up docker per the instructions here. However, when I ran an apt-get upgrade apt-get started downloading packages (not package lists) from ...
1
vote
1answer
229 views

Is my Windows Server Backup in Azure safe against ransomware attacks?

I am thinking of a backup plan for fast recovery scenario for my windows Azure hosted VM's. My plan is to create a backup disk that is attached to my VM and using Windows Server Backup I create a ...
-5
votes
1answer
539 views

Restore Shadow Copy Deleted by Ransomware

I got hit by the latest version of Crysis ransom ware on 14/09. I was lucky enough to pull the cable on the infected PC before it could spread to all servers on my network. However, it did spread to ...
1
vote
1answer
82 views

Configuring Applocker to try and prevent randsomware (through email); overkill?

I'm toying around with group policy (Self teaching myself) and have stumbled across applocker which i can certainly see the benefits for certain situations however in every company i've worked for ...
3
votes
1answer
422 views

How can I block/reject doc, docx containing macro on my mail server?

I'm wondering if it is possible to block/reject emails with .doc or .docx containing macro? Is there any solution for postfix to be used in order to reject this kind of attachments? Today I just ...
1
vote
1answer
4k views

wanna cry ransomware on LInux ?

Do Linux users bother about wanna cry ransomware. I am not talking about using windows emulation like WINE. All my servers and office desktops are on linux, I am assuming I am safe against at least ...
0
votes
1answer
131 views

Prevent Network Ransomware Malware Attack?

I have a small network of Windows 7 PCs. I want to use a Windows NAS file server as a repository to safeguard the backup files from each Windows PC against a ransomware attack. In order for this ...
9
votes
3answers
4k views

Can “wannacrypt” (wcrypt) spread via Linux server serving over SMB?

Is it possible, or will this only spread via a Windows machine serving over SMB? If Linux serving over SMB can spread wannacrypt, what's the approach to take?
0
votes
1answer
1k views

Something is setting IPSec policies and Firewall Rules. How can I find it? (Windows 2008R2) [duplicate]

Something on the server is automatically adding Deny rules on port 445 and a couple other ports. The rules are appearing in the Firewall and IP Security policies. They are blocking network and printer ...
0
votes
1answer
97 views

Unknown device: detected open ports on server that should not exist?

While running a network scan I found open tcp ports reported for a linux machine (port 22-Openssh debian; ports 5124/5127/7582/8282 - Tunnel is OpenSSL) but we only have one linux box and this was not ...
-1
votes
2answers
688 views

Update64.exe Using All CPU Resources

I have tried finding out what Update64.exe really does. I think it might be a virus but there's not much out there on the topic. Does anyone know how to fix this? It's using pretty much 80-100% of CPU....
7
votes
1answer
3k views

How to identify this mysterious Windows service

The name of the service is a 32-digit hex number. It might be randomly generated, since a Google search on the number did not find anything. It points to an EXE file which also has a hex number as ...
1
vote
3answers
127 views

Recognize rootkit-taken server

First, I'm not looking for software for detection of rootkits planted into server, as this may and may not work, especially on live system. I'm curious to find out what would be the signs of rootkit ...
0
votes
0answers
75 views

Sage2.0 Ransomware and Tomcat 7

We have a tomcat server running on window 2012 server which seems to be constantly being attached by Sage 2.0 ransomeware. Some details of the sever, 1) Tomcat is running on port 80 and 8080. 2) ...
2
votes
1answer
3k views

ClamAV and MalDet - Are these quarantined or infected?

Learning about hardening my VPS, I installed ClamAV and MalDet, using both for a few months. Tonight, I decided that, instead of just checking home I'd check the entire VPS other than "/sys". This ...
-1
votes
0answers
51 views

Nonexistent domain folder reappears with malware [closed]

If I'm sure the domain is not registered any more (since almost a year) I've deleted the FTP account to the folder of that "Addon Domain", deleted the folder, changed root cPanel's user password and ...
11
votes
3answers
1k views

Windows 2012 R2 - Search for Files using MD5 Hash?

My organization recently discovered malware that was sent to some users via email that managed to get past our email security in a sophisticated, targeted attack. The names of the files vary from user ...
65
votes
8answers
15k views

A previous IT worker probably left some backdoors. How can I eliminate them? [duplicate]

I started working for a company that fired a previous IT worker for leaking data. I can only say the following things: We use a Firebird DB with an application written by another company, Proxmox, ...
49
votes
8answers
8k views

Are zipped EXE files harmless for Linux servers?

I ran a malware scanner on my site, and it marked a bunch of zipped EXE files as potential risk files (these files got uploaded by users). Since I'm able to uncompress the files on my Mac I assume ...
1
vote
2answers
565 views

Maldet with ClamAV missing PHP base64_decode() & eval() hacks

I've installed Linux Malware Detect and ClamAV in my CentOS 7 server and seems it's all ok as it hits on the EICAR malware test files and does scheduled scans without issues. The problem comes when I ...
5
votes
1answer
2k views

How to scan for Windows viruses on Linux servers?

I have a CentOS server storing files for windows users. How do I scan for windows viruses in these files, and meanwhile prevent quarantine and other measures? I do not want the files altered in any ...
0
votes
1answer
833 views

How to get an email report of whatever the most recent maldet scan is?

The maldet / Rfxn Linux MalDetect docs give this for getting an email report even when nothing was found: -e, --report SCANID email View scan report of most recent scan or of a specific SCANID and ...
0
votes
1answer
4k views

Maldet - How to Exclude/Ignore a File From Scanning?

I am using maldetect on my server and a client is getting his file quarantined after maldet flags it as malicious. {CAV}Atomicorp.Zip.File.Contains.exe : /home/timsffco/public_html/downloads/timsff....
3
votes
1answer
517 views

Can hidden shares be discovered programmatically without network admin permissions?

I work in an IT department and we would like a network accessible folder to read and write data using our internal applications. So permissions need to be open to all users. But if a user gets malware ...