Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

Blocking everything from sending mail except postfix

How could I use iptables to block anything except the Postfix user from sending mail? It would be useful in case a web app such as wordpress got infected with malware and started sending spam. We ...
1
vote
0answers
20 views

How to detect an executable/file calling out a domain

I'm trying to trace an application/file that is calling out a domain(URL). I ran Process Monitor & Wireshark to find SVCHost.exe is responsible. However, I'm unable to locate which file ...
0
votes
1answer
70 views

Cleaning up after my Docker container got hit with the Kinsing malware

I have a VPS where I run an instance of devilbox, a dockerized LAMP stack. I just discovered that I got hit with the Kinsing malware, due most likely to a dockerized Redis server that I inadvertently ...
0
votes
0answers
15 views

lmd(linux malware detect) maldet -m --monitor, impact on performance [duplicate]

Maybe there are other places that talk about this, but I didn't found them. I want to know if someone have measured the impact that has having the maldet --monitor activated on the computer. I'm ...
1
vote
1answer
94 views

Infected server (bitcoin mining malware) [duplicate]

I found some strange process on my centos 8 machine check above photo: when I type cat /etc/passwd I don't see user 990 anywhere also this kinsing process is strange because this is the same process ...
0
votes
1answer
69 views

How to uninstall redis on Centos 8

How can i fully uninstall redis from my Centos 8 machine ? I have a malware that keeps getting in via redis 41533 redis 20 0 5883224 4.4g 2776 S 1593 13.9 13507:24 kdevtmpfsi
0
votes
0answers
25 views

Sites infected with malware, now seeing connectivity issues after cleaning

About a month and a half ago, all 5 of my wordpress websites being hosted on Bluehost were infected with malware. A week ago, I was made aware of this when my websites started redirecting users to ...
0
votes
1answer
46 views

Large Virus File with EICAR-Test-Signature not identified by the clamav library

If I add the Eicar Test Signature at the beginning of a large text file, will that file turn out to be malicious? I opened a 5 MB binary file on Sublime Text and added the signatue at the beginning. ...
0
votes
1answer
85 views

How to avoid getting the crypto miner virus

I'm about to install a new ubuntu server after having this virus https://askubuntu.com/questions/1115770/crond64-tsm-virus-in-ubuntu . When installing the new VPS I'm going to install clamav and ...
2
votes
0answers
49 views

Detecting .Money Ransomware on Windows Server 2019 [closed]

Problem A few weeks back we got hit with a Dharma Ransomware variant called "Money". We made the incorrect assumption that this variant began right at the time the user opened the malicious ...
0
votes
0answers
18 views

Found XMRig on ubuntu server, how to remove completely? [duplicate]

I recently noticed an unusual spike in my EC2 instance usage. When I checked back on my list of running processes I found xmrig to be using a lot of CPU percentage. I instinctively killed the process ...
0
votes
0answers
26 views

How to find who is spamming in my server if there is no trace in EXIM log [duplicate]

I have an odd problem. I received reports that my server is spamming the world right now. They reported me 8 fresh email headers of spammers, so I searched in email log /var/log/exim_mainlog . I ...
0
votes
0answers
45 views

Suspicious “clam” process on Debian 10

Using sudo htop I'm seeing 2 unusual processes named clamd on my Debian 10 VPS. Unusual because I don't remember installing ClamAV and they take 20% of my 4GB memory (htop screenshot below): ...
0
votes
0answers
11 views

Respawning Vulnerable Process After Killing Using PID [duplicate]

I am using ubuntu server. One process which is vulnerable and unwanted is consuming CPU about 90-100%. After killing this process using it PID. it remain silent about 1-2 minute and then respawn. Its ...
0
votes
0answers
27 views

Investigating on suspicious malware process in linux server [duplicate]

I've found a suspicious process on a linux server: # ps ax PID TTY STAT TIME COMMAND ... 31715 ? S 0:00 /tmp/.root.0.dir/.PqEvOn ... If I try to kill it, it remains up. If I hard ...
-1
votes
2answers
212 views

Malware infection possible on Cisco switches?

Are there any malware that target Cisco switches? I recently got one from a friend whose company threw them out after a ransomware attack, and are wondering if there is anything to be concerned about. ...
0
votes
0answers
13 views

Detect and clean nymaim on Ubuntu server? [duplicate]

I'm trying to figure out why our server has been block at Spamhaus. It comes up with: 139.162.208.xxx is listed in the XBL, because it appears in: CBL Lookup Following the link, it says: ...
1
vote
1answer
79 views

Server infected by recent cryptojacking malware but different (?) entry point

One of my servers has been infected by this cryptojacking malware (reporting to the very same IP than in the article). It seems known for this malware to propagate through some Confluence ...
0
votes
0answers
10 views

Humasn interfawce DeviceT AccessT High CPU usage [duplicate]

Note: The title is not a spelling mistake. We have a Windows Server running on AWS and it has a service running which is utilizing high CPU and RAM. A service named "Humasn interfawce DeviceT AccessT"...
0
votes
0answers
7 views

New SQL server jobs apeared look like virus or sth [duplicate]

today I checked SQL Server's jobs and I found some new jobs with strange names (bat.exe, cook.exe. dll.exe, ftpbacks.exe,regs.exe, tasks.exe, sqlrc, wmi, ...). Most of them are failed. How can I know ...
0
votes
0answers
61 views

My VPS tried to DDoS (or port scan) Columbia University, what can i do? [duplicate]

I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a MC ...
0
votes
0answers
36 views

Can I use OSSEC in a home LAN to monitor for intrusion and malwares?

I'm not quite sure I understand what OSSEC does. But after HiddenWasp, I would like to make sure my Windows and Linux machines in my home are safe. (And harden my VPS) Does OSSEC support antimalware ...
0
votes
0answers
10 views

Remove malware redtext from server [duplicate]

I'm trying to work out how to remove this Malware from my server: https://howtoremove.guide/remove-redtext-biz/ I was doing some work on the server, and happened to test a clients website and it ...
1
vote
1answer
31 views

Using e-mail on malware infected computer/network [closed]

I have an important (+10 outlook accounts) but very ignorant client who refuses to accept that there is malware on the company's computers. Malware that steals Outlook data to send and receive spam. ...
0
votes
0answers
49 views

Windows Defender Real Time Scan

Windows Defender would not detect in real time a new Malware hidden in a .zip file. If I scan the .zip file after it was downloaded from the website it does detect it and deletes it. Zip file is not ...
0
votes
1answer
20 views

discover additional scripts loaded from other sites when visiting a website with DNS

I noticed a (relatively) huge amount of dns packets in my wireshark recording while only visiting plain websites. Sites like amazon, facebook, comodoca and many others are requested by dns packets. So ...
0
votes
0answers
73 views

Monero hack survives reboot in linux [duplicate]

We recently had some servers hacked (Ubuntu, various flavours) which installed a Monero miner that starts a process called watchbog. We scrubbed them clean and blocked access to where they can update ...
0
votes
2answers
41 views

Unwanted emails are sent from some exchange users

In our exchange environment some unwanted emails are sent from a few users to abnormal addresses with .xyz suffix.They stuck in queue as the destination server isn't available. Affected users got ...
6
votes
4answers
2k views

Is this is a malware invocation of Powershell?

I got a file that was .avi at the fist glance, but then I found out that in fact this is a .lnk file, but it was too late. And the target element attribute of that file is C:\Windows\System32\...
1
vote
2answers
450 views

How to determine process which makes DNS Request? [duplicate]

I have a server on AWS, GuardDuty started send me notifications: *** "type":"Backdoor:EC2/C&CActivity.B!DNS", *** {"domain":"libcurl.so","protocol":"UDP","blocked":false} *** is querying a domain ...
0
votes
1answer
183 views

Process without name [duplicate]

I have a web server, due to an outdated Wordpress some hacker uploaded a webshell. Throught it, he launched a process but the ps command is not showing any name for the process: root@serv ~ # ps aux|...
1
vote
1answer
148 views

Why does my “ps aux” command column now show gibberish?

While using ps aux to find the PID of a process, I came across some output that prevented me from doing so. I've done this before, on this same server, within the last month. Today's output looked ...
0
votes
1answer
43 views

Windows Server 2011 - System opening ominous TCP connections

Where I work we have a Windows Server 2011 Small Business edition, and recently our Symantec software started reporting "blocked intrusion attempts" from port 80. Our routers do not forward any port ...
0
votes
1answer
791 views

Where does O365 track end user clicks on SafeLinks?

O365 SafeLinks policy has a setting to disable the per-user clicks of URLs in an email message. I want to obtain a report of potentially infected desktops where the user clicked on the URL and either ...
0
votes
2answers
162 views

Can I tell whether or not an internal user opened an email attachment?

We run Exchange 2010/Outlook 2013, and today a number of our users received an email with an attachment that contained malware. Our current anti-malware product didn't detect the malware, but I found ...
0
votes
1answer
70 views

HKCU Sotware In Registry & Malware

In reading about forensics its mentioned that malware could be found in the Software HKCU. My question is if malware installs will Windows definitely put it in this registry section? I always assumed ...
0
votes
0answers
141 views

I think I just found the encryption key used by ransomware on my server… how can I check?

Long story short, server ended up with a ton of encrypted files. IDRansomware thinks it was GlobeImposter 2.0, see here. I'm not 100% sure on that as I ended up with a ..rtf file extension on my ...
0
votes
1answer
113 views

Win10 PCs trying to connect to file shares on 10.10.10.1 for unknown reason

I'm routinely going through our firewall logs, and recently I noticed that a lot of our Windows 10 clients are trying to open file shares (or otherwise connect to tcp/445) on the IP 10.10.10.1. Since ...
0
votes
2answers
395 views

centos 7 high outbound traffic 50-80 MiB/s, trouble identifying process

I have an updated fresh install of CentOS 7. A day after installing I noticed a ton of outbound traffic coming from it, enough to slow the whole home network down and crash my Netgear n450 router. ...
0
votes
1answer
68 views

protect NAS shared folder against cryptolocker attack

I got a NAS with some shared folders, for access it a user/pass authentication is needed. My question is about how a malicious software (expecially a cryptolocker) can access to the network folder ...
0
votes
0answers
18 views

Miner bot taking up CPU on old server [duplicate]

I've been asked to take a look at an old web server (Ubuntu 12.04) which has been running very slow recently. After a quick check I found a process constantly topping the cpu: PID USER PR NI ...
1
vote
0answers
44 views

How to get rid of adfly javascript code to be inserted automatically in my web pages

in my website, adfly's javascript code is inserted automatically after every few hours in index.php and default.php web pages. Every time I remove these unwanted code from both pages manually and that ...
1
vote
1answer
398 views

Is my Windows Server Backup in Azure safe against ransomware attacks?

I am thinking of a backup plan for fast recovery scenario for my windows Azure hosted VM's. My plan is to create a backup disk that is attached to my VM and using Windows Server Backup I create a ...
-5
votes
1answer
1k views

Restore Shadow Copy Deleted by Ransomware

I got hit by the latest version of Crysis ransom ware on 14/09. I was lucky enough to pull the cable on the infected PC before it could spread to all servers on my network. However, it did spread to ...
1
vote
1answer
199 views

Configuring Applocker to try and prevent randsomware (through email); overkill?

I'm toying around with group policy (Self teaching myself) and have stumbled across applocker which i can certainly see the benefits for certain situations however in every company i've worked for ...
2
votes
1answer
1k views

How can I block/reject doc, docx containing macro on my mail server?

I'm wondering if it is possible to block/reject emails with .doc or .docx containing macro? Is there any solution for postfix to be used in order to reject this kind of attachments? Today I just ...
1
vote
1answer
4k views

wanna cry ransomware on LInux ?

Do Linux users bother about wanna cry ransomware. I am not talking about using windows emulation like WINE. All my servers and office desktops are on linux, I am assuming I am safe against at least ...
0
votes
1answer
157 views

Prevent Network Ransomware Malware Attack?

I have a small network of Windows 7 PCs. I want to use a Windows NAS file server as a repository to safeguard the backup files from each Windows PC against a ransomware attack. In order for this ...
8
votes
3answers
4k views

Can “wannacrypt” (wcrypt) spread via Linux server serving over SMB?

Is it possible, or will this only spread via a Windows machine serving over SMB? If Linux serving over SMB can spread wannacrypt, what's the approach to take?
0
votes
1answer
1k views

Something is setting IPSec policies and Firewall Rules. How can I find it? (Windows 2008R2) [duplicate]

Something on the server is automatically adding Deny rules on port 445 and a couple other ports. The rules are appearing in the Firewall and IP Security policies. They are blocking network and printer ...

1
2 3 4 5
7