Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

How to identify application that is generating ICMP echo requests on Windows 10?

My company security team has informed me that my workstation is pinging some "blacklisted" IP addresses. The enterprise security tool reporting this information sits in place of the usual ...
user avatar
0 votes
1 answer
35 views

Best practices for malware scanning on Ubuntu servers in production [closed]

There are multiple malware/rootkit scanning packages for ubuntu such as clamAV, rkhunter etc. I know how to use them manually but for multiple servers in production environment I could not find a ...
user avatar
  • 1,341
0 votes
1 answer
14 views

SPAM after activating WordPress plugin on Linux VPS

After activating a plugin I received an email that I had never recived before. What kind of miscellaneous code it might be? it's a coincidence? I received an email to my account Gmail that I never ...
user avatar
  • 1
1 vote
0 answers
37 views

Noexec vs chmod -R -x for malware interogation?

I am setting up a Linux box to examine malware samples. I wanted to create a directory where I could safely unzip each sample and run very basic triage commands against the file to collect ...
user avatar
  • 237
0 votes
0 answers
27 views

strange file in public_html folder wordpress [duplicate]

I found some strange file named as "zi1mQiuH" inside of public_html folder. the file size is 5GB Inside that file the code is like below format PK "¥R .well-known/UT ðk’`...
user avatar
0 votes
1 answer
435 views

Update From Debian 10 to Debian 11 Gone Wrong

I just upgrade from Debian 10 to Debian 11 using these instructions. Everything seems to have worked smoothly, except maldet is failing. This is the the error: maldet[2117]: maldet(2117): {mon} kernel ...
user avatar
0 votes
0 answers
24 views

Centos Infected By Kinsing Mining Malware [duplicate]

My server has been infected by Kinsing malware. I managed to clear it. Remove the cronjob. So far, it didn't return. However, I noticed, another running processes look fishy. Normally, I haven't ...
user avatar
0 votes
1 answer
582 views

Is there a (forensic) way to list past events/actions of a certain *.exe malware program (PUP-Proxygate, possibly a Trojan)?

There is a folder with suspicious *.exe files on a Win 10 PC, and there are (external) protocols of potentially unlawful actions coming from that PC at a certain time in the past. The first suspicious ...
user avatar
  • 19
0 votes
1 answer
204 views

Suspicious users with numbers are devouring entire CPU [duplicate]

On my test server which I have docker-run gitlab-ce, redis server and some other important services, I noticed I have an uninvited guest, kdevtmpfsi. I tried everything proposed by the community but I ...
user avatar
2 votes
1 answer
336 views

Compromised printer?

Today the office printer produced three sheets with what seems to be random characters, and in the middle a string random1random2random3random4. This raised a red flag with us. Is this something to be ...
user avatar
  • 31
0 votes
2 answers
57 views

How to restrict access between folders on the same virtual host

We plan to host WordPress Blog and an Ecommerce store on the same domain, so the URL's will look like this: example.com <--- Magento Store example.com/blog/ <--- WordPress Blog Our main concern ...
user avatar
  • 173
-2 votes
1 answer
108 views

Hundreds of suspicious messages coming from random sources [closed]

I'm having a serious problem and I'm getting out of options. Out of the blue, my Windows 10 laptop with McAfee started reporting hundreds of suspicious messages blocked by the laptop firewall (I don't ...
user avatar
  • 3
-5 votes
2 answers
123 views

Can I report malicious ip addresses for money?

My servers get attacks from thousands of ip addresses everyday. I have an idea. Can I report those malicious ip addresses, or use the resource to earn some money? How? You may think these attacks are ...
user avatar
  • 69
0 votes
1 answer
296 views

Cisco Umbrella Identifies DNS Request as Malicious and Looks Like it's From our Domain Controller

Our Cisco Umbrella service is identifying DNS requests to rev1.globalrootservers.net and rev2.globalrootservers.net as malicious. I am trying to figure out whether this is really a problem or if it is ...
user avatar
  • 29
0 votes
0 answers
94 views

IS this error an Ancient “su – hostile” vulnerability in Debian 8 & 9 ? $ bash: cannot set terminal process group (-1): Inappropriate ioctl for device

Just received this error >> bash: cannot set terminal process group (-1): Inappropriate ioctl for device then the disk partition went into READ-Only mode ; also noticed gnome-software was ...
user avatar
0 votes
1 answer
875 views

How does the Miner kinsing infects my system

I have - like few dozen others - the Miner kinsing in my deployment. Unlike the others I have an minimal server with no redis installed and also no cron. The only things I've installed is symfony, php-...
user avatar
0 votes
1 answer
64 views

How to stop my server from bruteforcing another [duplicate]

There are so many resources on how to stop bruteforce attacks on your server, but I can't find any good on bruteforce attacks FROM a shared hosting server. I am getting a lot of reports from many ...
user avatar
  • 101
0 votes
0 answers
49 views

license.php file is automatically getting created on shared hosting server

On my shared host, license.php file is automatically getting created at root folder/directory of every domain. I have find and deleted this file multiple times from everywhere. Here is the code of the ...
user avatar
0 votes
0 answers
21 views

Is there a command to list all active maldet scans?

I relatively often run 2 or more scans on a server simultaneously (unfortunately some servers contain many users that manage to get their files infected simultaneously) and on many of those occasions ...
user avatar
1 vote
0 answers
51 views

How to detect an executable/file calling out a domain

I'm trying to trace an application/file that is calling out a domain(URL). I ran Process Monitor & Wireshark to find SVCHost.exe is responsible. However, I'm unable to locate which file ...
user avatar
  • 11
0 votes
1 answer
680 views

Cleaning up after my Docker container got hit with the Kinsing malware

I have a VPS where I run an instance of devilbox, a dockerized LAMP stack. I just discovered that I got hit with the Kinsing malware, due most likely to a dockerized Redis server that I inadvertently ...
user avatar
  • 151
1 vote
1 answer
407 views

Infected server (bitcoin mining malware) [duplicate]

I found some strange process on my centos 8 machine check above photo: when I type cat /etc/passwd I don't see user 990 anywhere also this kinsing process is strange because this is the same process ...
user avatar
0 votes
1 answer
832 views

How to uninstall redis on Centos 8

How can i fully uninstall redis from my Centos 8 machine ? I have a malware that keeps getting in via redis 41533 redis 20 0 5883224 4.4g 2776 S 1593 13.9 13507:24 kdevtmpfsi
user avatar
1 vote
1 answer
877 views

Large Virus File with EICAR-Test-Signature not identified by the clamav library

If I add the Eicar Test Signature at the beginning of a large text file, will that file turn out to be malicious? I opened a 5 MB binary file on Sublime Text and added the signatue at the beginning. ...
user avatar
0 votes
1 answer
751 views

How to avoid getting the crypto miner virus

I'm about to install a new ubuntu server after having this virus https://askubuntu.com/questions/1115770/crond64-tsm-virus-in-ubuntu . When installing the new VPS I'm going to install clamav and ...
user avatar
  • 41
2 votes
0 answers
92 views

Detecting .Money Ransomware on Windows Server 2019 [closed]

Problem A few weeks back we got hit with a Dharma Ransomware variant called "Money". We made the incorrect assumption that this variant began right at the time the user opened the malicious ...
user avatar
  • 191
-1 votes
2 answers
974 views

Malware infection possible on Cisco switches?

Are there any malware that target Cisco switches? I recently got one from a friend whose company threw them out after a ransomware attack, and are wondering if there is anything to be concerned about. ...
user avatar
  • 103
0 votes
0 answers
13 views

Detect and clean nymaim on Ubuntu server? [duplicate]

I'm trying to figure out why our server has been block at Spamhaus. It comes up with: 139.162.208.xxx is listed in the XBL, because it appears in: CBL Lookup Following the link, it says: ...
user avatar
1 vote
1 answer
93 views

Server infected by recent cryptojacking malware but different (?) entry point

One of my servers has been infected by this cryptojacking malware (reporting to the very same IP than in the article). It seems known for this malware to propagate through some Confluence ...
user avatar
0 votes
0 answers
58 views

Can I use OSSEC in a home LAN to monitor for intrusion and malwares?

I'm not quite sure I understand what OSSEC does. But after HiddenWasp, I would like to make sure my Windows and Linux machines in my home are safe. (And harden my VPS) Does OSSEC support antimalware ...
user avatar
  • 113
1 vote
1 answer
32 views

Using e-mail on malware infected computer/network [closed]

I have an important (+10 outlook accounts) but very ignorant client who refuses to accept that there is malware on the company's computers. Malware that steals Outlook data to send and receive spam. ...
user avatar
0 votes
0 answers
63 views

Windows Defender Real Time Scan

Windows Defender would not detect in real time a new Malware hidden in a .zip file. If I scan the .zip file after it was downloaded from the website it does detect it and deletes it. Zip file is not ...
user avatar
  • 1
0 votes
1 answer
23 views

discover additional scripts loaded from other sites when visiting a website with DNS

I noticed a (relatively) huge amount of dns packets in my wireshark recording while only visiting plain websites. Sites like amazon, facebook, comodoca and many others are requested by dns packets. So ...
user avatar
0 votes
0 answers
96 views

Monero hack survives reboot in linux [duplicate]

We recently had some servers hacked (Ubuntu, various flavours) which installed a Monero miner that starts a process called watchbog. We scrubbed them clean and blocked access to where they can update ...
user avatar
0 votes
2 answers
58 views

Unwanted emails are sent from some exchange users

In our exchange environment some unwanted emails are sent from a few users to abnormal addresses with .xyz suffix.They stuck in queue as the destination server isn't available. Affected users got ...
user avatar
  • 251
6 votes
4 answers
2k views

Is this is a malware invocation of Powershell?

I got a file that was .avi at the fist glance, but then I found out that in fact this is a .lnk file, but it was too late. And the target element attribute of that file is C:\Windows\System32\...
user avatar
  • 191
2 votes
2 answers
2k views

How to determine process which makes DNS Request? [duplicate]

I have a server on AWS, GuardDuty started send me notifications: *** "type":"Backdoor:EC2/C&CActivity.B!DNS", *** {"domain":"libcurl.so","protocol":"UDP","blocked":false} *** is querying a domain ...
user avatar
  • 245
0 votes
1 answer
512 views

Process without name [duplicate]

I have a web server, due to an outdated Wordpress some hacker uploaded a webshell. Throught it, he launched a process but the ps command is not showing any name for the process: root@serv ~ # ps aux|...
user avatar
  • 1
1 vote
1 answer
244 views

Why does my "ps aux" command column now show gibberish?

While using ps aux to find the PID of a process, I came across some output that prevented me from doing so. I've done this before, on this same server, within the last month. Today's output looked ...
user avatar
  • 532
0 votes
1 answer
55 views

Windows Server 2011 - System opening ominous TCP connections

Where I work we have a Windows Server 2011 Small Business edition, and recently our Symantec software started reporting "blocked intrusion attempts" from port 80. Our routers do not forward any port ...
user avatar
0 votes
2 answers
4k views

Where does O365 track end user clicks on SafeLinks?

O365 SafeLinks policy has a setting to disable the per-user clicks of URLs in an email message. I want to obtain a report of potentially infected desktops where the user clicked on the URL and either ...
user avatar
  • 91
0 votes
2 answers
947 views

Can I tell whether or not an internal user opened an email attachment?

We run Exchange 2010/Outlook 2013, and today a number of our users received an email with an attachment that contained malware. Our current anti-malware product didn't detect the malware, but I found ...
user avatar
  • 233
0 votes
1 answer
116 views

HKCU Sotware In Registry & Malware

In reading about forensics its mentioned that malware could be found in the Software HKCU. My question is if malware installs will Windows definitely put it in this registry section? I always assumed ...
user avatar
0 votes
0 answers
158 views

I think I just found the encryption key used by ransomware on my server... how can I check?

Long story short, server ended up with a ton of encrypted files. IDRansomware thinks it was GlobeImposter 2.0, see here. I'm not 100% sure on that as I ended up with a ..rtf file extension on my ...
user avatar
  • 525
0 votes
1 answer
217 views

Win10 PCs trying to connect to file shares on 10.10.10.1 for unknown reason

I'm routinely going through our firewall logs, and recently I noticed that a lot of our Windows 10 clients are trying to open file shares (or otherwise connect to tcp/445) on the IP 10.10.10.1. Since ...
user avatar
  • 145
0 votes
2 answers
654 views

centos 7 high outbound traffic 50-80 MiB/s, trouble identifying process

I have an updated fresh install of CentOS 7. A day after installing I noticed a ton of outbound traffic coming from it, enough to slow the whole home network down and crash my Netgear n450 router. ...
user avatar
0 votes
1 answer
78 views

protect NAS shared folder against cryptolocker attack

I got a NAS with some shared folders, for access it a user/pass authentication is needed. My question is about how a malicious software (expecially a cryptolocker) can access to the network folder ...
user avatar
  • 103
0 votes
0 answers
19 views

Miner bot taking up CPU on old server [duplicate]

I've been asked to take a look at an old web server (Ubuntu 12.04) which has been running very slow recently. After a quick check I found a process constantly topping the cpu: PID USER PR NI ...
user avatar
  • 274
1 vote
0 answers
50 views

How to get rid of adfly javascript code to be inserted automatically in my web pages

in my website, adfly's javascript code is inserted automatically after every few hours in index.php and default.php web pages. Every time I remove these unwanted code from both pages manually and that ...
user avatar
  • 111
1 vote
1 answer
459 views

Is my Windows Server Backup in Azure safe against ransomware attacks?

I am thinking of a backup plan for fast recovery scenario for my windows Azure hosted VM's. My plan is to create a backup disk that is attached to my VM and using Windows Server Backup I create a ...
user avatar

1
2 3 4 5
7