Questions tagged [malware]
Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
336
questions
1
vote
1
answer
113
views
Is there a tool like ClamAV to scan PHP and JS files?
We're offering a shared web hosting service, where many websites live on the same server.
Since a lot of people don't update their stuff, they get pirated all the time. Now, the websites are ...
0
votes
0
answers
29
views
Kill a malware process running in the background [duplicate]
I have a WordPress site sitting on a Docker container and which was infected by a malware. I noticed that when I try to remove the malware, it gets back again after a few seconds. When I run a process ...
0
votes
0
answers
31
views
/usr/lib/sys/sysinit is it a virus [duplicate]
i have a little experince in managiing debian server.
at the last few days i found a strange behaviour from my apache2 host web app
in term of failer to upload files with "UPLOAD_ERR_NO_TMP_DIR: ...
0
votes
0
answers
42
views
Centos :: Can't delete file with "rm" under "/", operation is not permitted [duplicate]
I have a CentOS server.It has been hasked.There are some malicious file under "/", like "/11db32e5", the AV scanner say it is a "HackTool/Linux.CoinMiner.n". But i cannot ...
0
votes
0
answers
79
views
Cuckoo sandbox - Failure in AnalysisManager.run
I have cuckoo running on Debian 10 with an Ubuntu guest VM. I submit a file for analysis, it runs and says "reported" but the report loads a 404 page. I see the following on the cuckoo ...
0
votes
0
answers
29
views
Someone installed a cryptominer on my Ubuntu server [duplicate]
It seems someone gained access to my ubuntu server and installed a cryptominer. This user added a crontab for the user "git" on my server. I disconnected the server from the internet and I ...
-1
votes
1
answer
1k
views
ClamAV detected Win.Virus.Expiro-10004389-0 malware on Ubuntu instance in Conda package
Today clamAV scanned my AWS instances and detect infected files on each. It looks like false positive due to several reasons:
All these files are created in 2021 (why were they detected only
now?)
...
0
votes
0
answers
20
views
How to detect what is starting malicious processes on my server? [duplicate]
I recently noticed an exceptionally high outbound bandwidth from my Ubuntu 22.04 server. I saw a process with a random name (something like sdfgardfh) with a high CPU usage, and suspected that it ...
0
votes
0
answers
275
views
How to resolve infection SMW-INJ-15328-cron.bkdr.perl-3 found by ImunifyAv
I have a report of a malware infection from imunifyAv and this is all I'm given:
SHELL="/usr/local/cpanel/bin/jailshell"
*/9 * * * * perl /var/tmp/CpUOSh >/dev/null 2>&1
Reason: ...
10
votes
4
answers
7k
views
ClamAV detected Kaiji malware on Ubuntu instance
Today clamAV scanned my AWS instances and detect 24 infected files on each.
It looks like false positive due to several reasons:
All these files are created in October 2022 (why were they detected ...
0
votes
0
answers
99
views
How does pandora.x86 infect cloud servers?
We have a cloud server instance hosted at vultr. A previous instance at this provider has been infected by pandora.x86 a few weeks ago, causing 100% CPU load and over 1TB of traffic. (We believe it is ...
0
votes
0
answers
17
views
Wordpress - can't get rid of malware - can I use .htaccess to restrict? [duplicate]
I'm not a newbie to WordPress, but definitely a newb to getting hacked. I am trying to remove some malware from a site but it just keeps coming back.
I am using wordfence to find malware and I keep ...
0
votes
2
answers
51
views
Why not nuke an machine after malware cleanup? [closed]
So this is a noob question.
Why do we perform a clean up on a machine that has been infected with malware and not nuke it directly instead? I understand that in some situations this would not be ...
0
votes
0
answers
220
views
cyberscan.io: Do something against scanning?
I receive a lot of 404 from cyberscan.io:
34.159.13.2 - - [11/Aug/2022:17:32:18 +0200] "GET /cgi/en/index.html HTTP/1.1" 404 522 "-" "cyberscan.io"
34.159.13.2 - - [11/...
0
votes
0
answers
22
views
Malware causing untraceable entries in apache2's error_log [duplicate]
My apache
Server version: Apache/2.4.54 (Ubuntu)
Server built: 2022-06-08T15:59:20
is configured as follows
ErrorLog ${APACHE_LOG_DIR}/error.log
ErrorLogFormat "[%t] [%l] [pid %P] %F: %E: [...
0
votes
0
answers
710
views
How to identify application that is generating ICMP echo requests on Windows 10?
My company security team has informed me that my workstation is pinging some "blacklisted" IP addresses. The enterprise security tool reporting this information sits in place of the usual ...
0
votes
1
answer
304
views
Best practices for malware scanning on Ubuntu servers in production [closed]
There are multiple malware/rootkit scanning packages for ubuntu such as clamAV, rkhunter etc. I know how to use them manually but for multiple servers in production environment I could not find a ...
0
votes
1
answer
37
views
SPAM after activating WordPress plugin on Linux VPS
After activating a plugin I received an email that I had never recived before. What kind of miscellaneous code it might be? it's a coincidence? I received an email to my account Gmail that I never ...
1
vote
0
answers
135
views
Noexec vs chmod -R -x for malware interogation?
I am setting up a Linux box to examine malware samples. I wanted to create a directory where I could safely unzip each sample and run very basic triage commands against the file to collect ...
0
votes
1
answer
1k
views
Update From Debian 10 to Debian 11 Gone Wrong
I just upgrade from Debian 10 to Debian 11 using these instructions. Everything seems to have worked smoothly, except maldet is failing.
This is the the error:
maldet[2117]: maldet(2117): {mon} kernel ...
0
votes
1
answer
599
views
Is there a (forensic) way to list past events/actions of a certain *.exe malware program (PUP-Proxygate, possibly a Trojan)?
There is a folder with suspicious *.exe files on a Win 10 PC, and there are (external) protocols of potentially unlawful actions coming from that PC at a certain time in the past. The first suspicious ...
0
votes
1
answer
295
views
Suspicious users with numbers are devouring entire CPU [duplicate]
On my test server which I have docker-run gitlab-ce, redis server and some other important services, I noticed I have an uninvited guest, kdevtmpfsi. I tried everything proposed by the community but I ...
2
votes
1
answer
959
views
Compromised printer?
Today the office printer produced three sheets with what seems to be random characters, and in the middle a string random1random2random3random4. This raised a red flag with us. Is this something to be ...
0
votes
2
answers
172
views
How to restrict access between folders on the same virtual host
We plan to host WordPress Blog and an Ecommerce store on the same domain, so the URL's will look like this:
example.com <--- Magento Store
example.com/blog/ <--- WordPress Blog
Our main concern ...
-2
votes
1
answer
126
views
Hundreds of suspicious messages coming from random sources [closed]
I'm having a serious problem and I'm getting out of options.
Out of the blue, my Windows 10 laptop with McAfee started reporting hundreds of suspicious messages blocked by the laptop firewall (I don't ...
-5
votes
2
answers
156
views
Can I report malicious ip addresses for money?
My servers get attacks from thousands of ip addresses everyday. I have an idea. Can I report those malicious ip addresses, or use the resource to earn some money? How?
You may think these attacks are ...
0
votes
1
answer
684
views
Cisco Umbrella Identifies DNS Request as Malicious and Looks Like it's From our Domain Controller
Our Cisco Umbrella service is identifying DNS requests to rev1.globalrootservers.net and rev2.globalrootservers.net as malicious. I am trying to figure out whether this is really a problem or if it is ...
0
votes
0
answers
135
views
IS this error an Ancient “su – hostile” vulnerability in Debian 8 & 9 ? $ bash: cannot set terminal process group (-1): Inappropriate ioctl for device
Just received this error >>
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
then the disk partition went into READ-Only mode ; also noticed gnome-software was ...
0
votes
1
answer
1k
views
How does the Miner kinsing infects my system
I have - like few dozen others - the Miner kinsing in my deployment.
Unlike the others I have an minimal server with no redis installed and also no cron.
The only things I've installed is symfony, php-...
0
votes
1
answer
86
views
How to stop my server from bruteforcing another [duplicate]
There are so many resources on how to stop bruteforce attacks on your server, but I can't find any good on bruteforce attacks FROM a shared hosting server.
I am getting a lot of reports from many ...
0
votes
0
answers
136
views
license.php file is automatically getting created on shared hosting server
On my shared host, license.php file is automatically getting created at root folder/directory of every domain. I have find and deleted this file multiple times from everywhere.
Here is the code of the ...
0
votes
0
answers
121
views
Is there a command to list all active maldet scans?
I relatively often run 2 or more scans on a server simultaneously (unfortunately some servers contain many users that manage to get their files infected simultaneously) and on many of those occasions ...
1
vote
0
answers
207
views
How to detect an executable/file calling out a domain
I'm trying to trace an application/file that is calling out a domain(URL). I ran Process Monitor & Wireshark to find SVCHost.exe is responsible.
However, I'm unable to locate which file ...
0
votes
1
answer
867
views
Cleaning up after my Docker container got hit with the Kinsing malware
I have a VPS where I run an instance of devilbox, a dockerized LAMP stack. I just discovered that I got hit with the Kinsing malware, due most likely to a dockerized Redis server that I inadvertently ...
1
vote
1
answer
444
views
Infected server (bitcoin mining malware) [duplicate]
I found some strange process on my centos 8 machine check above photo:
when I type cat /etc/passwd I don't see user 990 anywhere also this kinsing process is strange because this is the same process ...
0
votes
1
answer
2k
views
How to uninstall redis on Centos 8
How can i fully uninstall redis from my Centos 8 machine ?
I have a malware that keeps getting in via redis
41533 redis 20 0 5883224 4.4g 2776 S 1593 13.9 13507:24 kdevtmpfsi
3
votes
1
answer
2k
views
Large Virus File with EICAR-Test-Signature not identified by the clamav library
If I add the Eicar Test Signature at the beginning of a large text file, will that file turn out to be malicious? I opened a 5 MB binary file on Sublime Text and added the signatue at the beginning. ...
0
votes
1
answer
1k
views
How to avoid getting the crypto miner virus
I'm about to install a new ubuntu server after having this virus https://askubuntu.com/questions/1115770/crond64-tsm-virus-in-ubuntu .
When installing the new VPS I'm going to install clamav and ...
2
votes
0
answers
96
views
Detecting .Money Ransomware on Windows Server 2019 [closed]
Problem
A few weeks back we got hit with a Dharma Ransomware variant called "Money". We made the incorrect assumption that this variant began right at the time the user opened the malicious ...
-1
votes
2
answers
2k
views
Malware infection possible on Cisco switches?
Are there any malware that target Cisco switches? I recently got one from a friend whose company threw them out after a ransomware attack, and are wondering if there is anything to be concerned about.
...
0
votes
0
answers
13
views
Detect and clean nymaim on Ubuntu server? [duplicate]
I'm trying to figure out why our server has been block at Spamhaus. It comes up with:
139.162.208.xxx is listed in the XBL, because it appears in:
CBL Lookup
Following the link, it says:
...
1
vote
1
answer
101
views
Server infected by recent cryptojacking malware but different (?) entry point
One of my servers has been infected by this cryptojacking malware (reporting to the very same IP than in the article).
It seems known for this malware to propagate through some Confluence ...
0
votes
0
answers
89
views
Can I use OSSEC in a home LAN to monitor for intrusion and malwares?
I'm not quite sure I understand what OSSEC does. But after HiddenWasp, I would like to make sure my Windows and Linux machines in my home are safe. (And harden my VPS)
Does OSSEC support antimalware ...
1
vote
1
answer
35
views
Using e-mail on malware infected computer/network [closed]
I have an important (+10 outlook accounts) but very ignorant client who refuses to accept that there is malware on the company's computers. Malware that steals Outlook data to send and receive spam. ...
0
votes
0
answers
96
views
Windows Defender Real Time Scan
Windows Defender would not detect in real time a new Malware hidden in a .zip file.
If I scan the .zip file after it was downloaded from the website it does detect it and deletes it.
Zip file is not ...
0
votes
1
answer
44
views
discover additional scripts loaded from other sites when visiting a website with DNS
I noticed a (relatively) huge amount of dns packets in my wireshark recording while only visiting plain websites. Sites like amazon, facebook, comodoca and many others are requested by dns packets. So ...
0
votes
0
answers
100
views
Monero hack survives reboot in linux [duplicate]
We recently had some servers hacked (Ubuntu, various flavours) which installed a Monero miner that starts a process called watchbog. We scrubbed them clean and blocked access to where they can update ...
0
votes
2
answers
89
views
Unwanted emails are sent from some exchange users
In our exchange environment some unwanted emails are sent from a few users to abnormal addresses with .xyz suffix.They stuck in queue as the destination server isn't available.
Affected users got ...
6
votes
4
answers
3k
views
Is this is a malware invocation of Powershell?
I got a file that was .avi at the fist glance, but then I found out that in fact this is a .lnk file, but it was too late.
And the target element attribute of that file is
C:\Windows\System32\...
2
votes
2
answers
4k
views
How to determine process which makes DNS Request? [duplicate]
I have a server on AWS, GuardDuty started send me notifications:
*** "type":"Backdoor:EC2/C&CActivity.B!DNS",
*** {"domain":"libcurl.so","protocol":"UDP","blocked":false}
*** is querying a domain ...