Questions tagged [malware]
Questions relating to malicious software
444
questions
0
votes
1
answer
29
views
Is it possible to see what processes did last mounted USB device?
Is it possible to see what last mounted USB device? I am afraid, that last device infected my ubuntu machine and want to find out something about that device.
- 29
0
votes
0
answers
69
views
Ubuntu 23.04 clamtk: libjson-c.so.3: cannot open shared object file: No such file or directory
I cant use the program for years now. What is wrong here?
- 1
2
votes
0
answers
298
views
BLACKLOTUS UEFI virus: windows cannot avoid but how about Ubuntu?
Windows is facing a serious threat but what about Ubuntu? Is there any way to avoid UEFI in the boot process or not be affected by BLACKLOTUS?
https://www.schneier.com/blog/archives/2023/03/blacklotus-...
- 37
0
votes
1
answer
150
views
Linux Malware Detection - Malware in LMD folder found
I recently ran a full scan of my Ubuntu 22.04 LTS system and maldet reported these two files:
maldet(3692653): {quar} malware quarantined from '/home/davids/LMD/maldetect-current/maldetect-1.6.4/files/...
- 133
1
vote
1
answer
45
views
Compromised Ubuntu? Weird unauthorised iso file downloads and download attempts
I noticed 2 failed attempts at downloading an iso file in my Downloads, that were attempted without my knowing. It happened while I was using the computer (attempt time 10:06, screenshot 1). The ...
- 11
2
votes
1
answer
241
views
How do I know if Ubuntu 22.04 has any virus?
I have a Windows / Ubuntu 22.04 dual boot. I get screen artifacts as shown below.
At that moment, what I restarted Ubuntu. When it turned on, it no longer appeared and, until now all the applications ...
- 23
0
votes
0
answers
190
views
kdevtmpfsi using the entire CPU
I noticed the cpu on ubuntu is 100% used by a process named kdevtmpfsi
Anyone know what this is -is it malware?
In /var/spool/cron/crontabs/www-data i came across the following cron job:
# DO NOT EDIT ...
- 121
1
vote
1
answer
54
views
I possibly installed a malware by a misspelled java installation command in the terminal
I was trying to download java, more specifically, JDK version 16. The right command was sudo apt install openjdk-16-jdk, but I end up typing sudo apt install open-jdk-11 instead, the funny thing is ...
- 21
0
votes
0
answers
65
views
Files Unexpectedly Identified as Trojans by ClamAV
ClamAV has produced some unexpected results from a recent scan:
Are the files in libxkbcommon and node_modules really trojans and exploits, or is this an example of Clam not doing what it's supposed ...
- 21
0
votes
0
answers
104
views
my homedisk erased, is this malware or a systemfault?
After trying to save a spreadsheet, LibreOffice was hanging and could not be used anymore. I recently installed 20.045 so I decided to reinstall it. I first made an rsync of my homedirectory which is ...
- 721
1
vote
0
answers
48
views
Is this system affected by CVE-2019-7304?
I am analyzing a system that since a month shows two new users in the login screen.
After some research I stumbled over the exploit of snap: CVE-2019-7304
I checked the passwd file and found a new ...
- 111
0
votes
0
answers
462
views
rkhunter warnings
Hi I just ran rkhunters and got a lot of warnings which are not the first ones I found the first time a I ran it.
I'll drop here the results to see if someone can help me and tell tell me if they are ...
- 9
1
vote
1
answer
182
views
chkrootkit says "grep --color=auto INFECTED," what should I do?
I just installed and ran chkrootkit for the first time and when I ran sudo chkrootkit | grep INFECTED, it returned ![user] 21342 pts/0 grep --color=auto INFECTED
I'm a complete novice at this and ...
- 11
0
votes
0
answers
94
views
Clamscan cannot remove 'Read Only' viruses in /media/user/Windows
I ran a clamscan -r -i --remove / on my Ubuntu 22.04, which is installed alongside Windows 10 on my computer, and it gave me the following results:
/media/<me>/Windows/Program Files/Common Files/...
- 1
0
votes
0
answers
38
views
key strokes take a long time to register, ubuntu 16.04, ubuntu 18.04, etc
No matter what Ubuntu version or kernel version, some time after install it comes to the point where keystrokes take a long time to register. Sometimes it misses a character or duplicates a character,...
- 11
0
votes
1
answer
140
views
How to use wine with more security?
This question may sound duplicate but please read. I am trying to make a cross compiled application. So I would like to try mingw64. But while installing it I found that it requires wine. I have heard ...
- 121
0
votes
1
answer
163
views
What is the Generic Drive that keeps beeping on and off
Symptoms:
Once booted and logged in: Computer beeps (same as attaching an
external USB drive) then beeps (same as detaching an external USB
drive). Frequent. Erratic. (Annoying. Worrisome: is ...
- 1
0
votes
0
answers
346
views
Missing Inotify Pidfile Can't Start Maldet Service
I am running Ubuntu 20.04 on both my test and prod servers and I have exactly the same configs for maldet 1.6.4:
/usr/local/maldet/conf.maldet
/usr/local/maldetect/internals/functions
/lib/systemd/...
- 509
0
votes
0
answers
57
views
Ubuntu hogging internet data even when idle
Ubuntu 20.04. I just connected my Ubuntu laptop that has negligible amount of apps installed to my WiFi. It's the only connected device to the router. My router is blinking rapidly, it does that when ...
- 121
1
vote
0
answers
43
views
Possible windows virus infection?
Our IT team reported that a virus scan they did against an ubuntu server came back with:
/sys/kernel/boot_params/data: Win.Trojan.Blackhole-36 FOUND
When I looked at that file I can see text like
^...
- 11
0
votes
0
answers
163
views
New User needs help removing root kit virus
I clicked on a PUP pretending to be Norton and then subsequently installed Malware/Trojan. This virus overwrites the firmware of your router and redirects your DNS (doing a hardware reset does not ...
- 1
25
votes
5
answers
6k
views
Can windows viruses affect my encrypted linux partition on the same disk?
Can Windows viruses affect my encrypted Linux partition on the same disk? I just want to use Windows but I am concerned.
- 317
2
votes
1
answer
325
views
pmproxy using 100% CPU
For a couple days now, I notice a process called pmproxy using 100% CPU on bootup and stays at 100%. I kill the process and it restarts a couple seconds later. I renamed the folder /usr/lib/pcp and ...
- 21
6
votes
0
answers
365
views
Rkhunter still relevant in 2022?
I tried using the RKHunter 1.4.6 (http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz) in Ubuntu20.04 , it is around 4 years old , running it did not find any ...
- 61
0
votes
1
answer
267
views
LMD on Ubuntu 20.04 Server
Despite haviing ClamAV-Daemon installed, LMD / inotify always execute usr/bin/clamscan for scans, rather than using clamd, causes 100% CPU usage spikes.
I've checked the /usr/local/maletect/conf....
- 509
0
votes
0
answers
69
views
What is that .libs directory in the Desktop
What is that .libs directory in the Desktop created by, usually? I've just seen it for the first time. It contains nothing in it, but I am suspicious of it as I haven't run anything on the Desktop ...
- 197
0
votes
0
answers
94
views
How can I ensure that Impress / Powerpoint presentations are virus free?
I use Ubuntu 20.04.
I am aware that viruses exists for all operating systems (Linux included). However, it is rather uncommon to get infected on Ubuntu. Besides that, to avoid any malicious software, ...
- 1,079
3
votes
0
answers
394
views
Finding the unsigned and out-of-tree loaded kernel modules?
I just tried the
cat /proc/sys/kernel/tainted
command and the return value is 12289.
0 1 A module with a non-GPL license has been loaded, this
includes modules with no ...
- 217
1
vote
1
answer
35
views
Question about dual boot
If my Windows gets infected can linux compatible malware pass to Ubuntu? I just wanted to know the method used by the malware since the Ubuntu partition is disabled in Windows.
Thanks in advance.
- 11
0
votes
0
answers
110
views
Does LMD and ClamAV have any packages for sending reports to a monitoring console?
I currently have about forty Ubuntu Servers (mostly 18.04 and 20.04) that I am installing ClamAV and maldetect on so we have at least some monitoring for malware on the systems. What we will likely do ...
- 372
0
votes
2
answers
474
views
Can a virus be installed just by downloading a file?
Let´s assume that I programmatically download a malicious file, e.g. using wget, and try to import in e.g. R or Python as a text file. If it fails, I delete it using rm. There is any chance that my ...
- 145
0
votes
0
answers
31
views
Antivirus in Ubuntu? [duplicate]
I have recently made a switch to Ubuntu from Windows just because Windows is more prone to viruses. We all know Ubuntu isn't also 100% immune to viruses/intruders. Is there any need of installing ...
1
vote
1
answer
1k
views
How to stop outgoing brute force attack
I got a email from my ISP that my server tried to access another server via ssh multiple times.
I ran multiple scans on the hole machine and it turns up nothing.
Any idea how I can remove the malware ...
- 13
0
votes
0
answers
233
views
Suspected exploit log_rotari2
Recently performance of my Ubuntu 18 server heavily degraded. I found in process list the following process, which consumes all CPU of my server.
./log_rotari2 --coin monero -o suxsuxsux.com:3333 -u ...
- 101
7
votes
3
answers
6k
views
A crypto-mining process keeps appearing on server
I recently started using a remote Ubuntu server for development and testing machine. However the hosting provider reported a crypto mining process was running and he had to shut down the server.
There ...
- 259
0
votes
1
answer
290
views
How to selectively delete infected files
clamscan found these infected files:
/home/ludvig/.steam/debian-installation/steamapps/common/Proton 6.3/dist/lib64/wine/wordpad.exe: Win.Packed.Pwsx-9885269-0 FOUND
/home/ludvig/.steam/debian-...
- 103
0
votes
0
answers
206
views
Are Windows viruses recognized by AppArmor or SELinux?
I know windows and Linux are completely different environments but are there developers that implement the recognition of windows viruses in AppArmor or SELinux?
I'd like it so you don't have to scan ...
1
vote
0
answers
109
views
How do I know if someone is cryptojacking my system?
I recently installed Ubuntu 20.04 LTS and updated. I found my pc fan running whenever it wanted and also i saw my battery getting draining very fast. Can someone help me solve this issue. I also saw ...
8
votes
1
answer
1k
views
What is @!72,27;BDH and @!0,27;BDH?
There are other posts here asking about a mysterious program called @!0,27;BDH.
This program (is it a program?) appeared out of nowhere for me after I upgraded from 20.10 to 21.04 last Friday.
I ...
- 103
2
votes
1
answer
4k
views
How to print the location of malware in the terminal with ClamAV?
When I use
clamscan -r --bell -i /
(scan the whole system, output only when warning appear)
I get this warning in the terminal
LibClamAV Warning: PNG: Unexpected early end-of-file.
How can I get the ...
0
votes
1
answer
809
views
Chrome Consuming a lot of CPU Resources (Possible bg Crypto Miner)
community,
It's been a month and I feel there is some fishy things going on in my chrome ubuntu 20.04. I think there is a possibility of a miner script running in the background.
With hardly 10 open ...
0
votes
1
answer
66
views
Is downloading a pdf from google drive resource intensive? (firefox)
I tried downloading three pdfs via google drive through firefox.
All of a sudden, my laptop - lenovo ideapad 330s heated up while the pdfs havent finished downloading at all. I downloaded htop to see ...
- 75
1
vote
2
answers
156
views
I possibly installed malware, help please
I was looking for a Twitter app on Ubuntu Software Centre and I downloaded a fake Twitter app from snapcraft. Didn't notice and didn't read the comments before I hit install, like an idiot. The name ...
- 31
0
votes
0
answers
473
views
ClamAV MD5 sum based whitelists (*.fp) don’t work in Ubuntu MATE 20.04.2
Trying to make ClamAV ignore several files. These are almost cryptocoin miners which I do use. Cryptocoin miners get flagged by most antivirus programs for they can be distributed as malware (using ...
- 1
1
vote
0
answers
59
views
What are people using currently for virus and malware checks? [duplicate]
What are people using currently for virus and malware checks? I realize there is far less need for this with Linux than with Windows, but I still prefer wearing a seat belt just moving my car out of ...
- 565
0
votes
1
answer
1k
views
Disk Full, Can't login
I'm running Kubuntu 20.10.
I had at least some 5 GB free earlier today. Then apps started acting up. I checked in dolphin, and found I had 0 GB free. I cleared space, at least 2 GB, but it filled up ...
- 145
0
votes
0
answers
62
views
Unknown display font detected on ubuntu
I just suddenly started seeing what is in the screenshot below and I don't know how it came to be. I don't even know if it is a virus or so. Surfed the internet for solutions but found none.
How can ...
- 421
0
votes
1
answer
621
views
Ubuntu / Linux / Windows Virus wrote to my "read only" 20.04.1 Live USB (Twice!) and infected two separate live USB's! How is this possible?
Ok. Hang on to your hats! This is going to sound crazy but I have been attacked by some crazy hacker malware. I believe it started out as a file-less attack on my Widoze 10 Home partition and spread ...
- 11
1
vote
1
answer
356
views
Is rkhunter still required and appropriate? Nothing seems to have been written on it since 2015. Thanks
I want to use my Ubuntu 20.10 Groovy Gorilla desktop for internet banking and making purchases. Good digital hygiene is of course the first defence but i'd like to make sure that rootkits are ...
- 77
1
vote
1
answer
886
views
kinsing miner fix - help needed
Ineed some help removing this kinsing virus (bitcoin miner).
Currently I have this script running every 5 minnutes via a cronjob
sudo kill $(pidof kdevtmpfsi) || True
sudo kill $(pidof kinsing) || ...
- 113