2

this morning, I watched a monthly webinar about IT-Security. One of the actual topics was the malware "mumblehard". This malware makes your server to a part of a botnet and sends spam via email. The malware is locate in the /tmp or /var/tmp folder. So I looked up to this folder and I saw a few folders. One of them was an owncloud folder, which named "owncloud-occ23cq12x22...". The moderator of the webinar said, that a folder with chars like in this example above is the malware folder. I restarted my server, because the tmp folder will be cleared. Now ist is nothing in this folder (mc folder for midnight-commander only). Is it possible, that this was the malware or is it normal, that owncloud create this tmp folder? I have installed owncloud on my webserver.

Thanks

1 Answer 1

2

It is perfectly normal for software to create files and their own directory in /tmp/ to store temporary files (most likely these are session related files). That is what /tmp/ is for.

In general these files contain the name of the software (like your example with owncloud* and a "random" set of characters behind it). If you never installed owncloud and you have these files I'd expect something to be wrong. If you did install (as you did) it I would assume all is fine.

In my own /tmp/ I have a sni-qt_synergy. Synergy is software to connect 2 systems to 1 mouse and keyboard. You will also see this behaviour when using encryption (though this probably will be outside of /tmp/).

At the moment and with the information you provided I would say: perfectly normal.


Related to the malware: it is installed from WordPress and Joomla exploits and a cracked DirectMailer (if you do not have these you are safe(r)) and detection is very simple since it creates its own cron job. A crontab -l used with root and a more /etc/crontab will always reveal if this malware is present on your system

Remove that cron job, clean /tmp (or /var/tmp) and delete the cracked DirectMailer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .