Questions tagged [malware]
Questions relating to malicious software
461
questions
22
votes
5
answers
5k
views
Can windows viruses affect my encrypted linux partition on the same disk?
Can Windows viruses affect my encrypted Linux partition on the same disk? I just want to use Windows but I am concerned.
- 257
2
votes
1
answer
37
views
pmproxy using 100% CPU
For a couple days now, I notice a process called pmproxy using 100% CPU on bootup and stays at 100%. I kill the process and it restarts a couple seconds later. I renamed the folder /usr/lib/pcp and ...
- 21
3
votes
0
answers
87
views
Rkhunter still relevant in 2022?
I tried using the RKHunter 1.4.6 (http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz) in Ubuntu20.04 , it is around 4 years old , running it did not find any ...
- 31
0
votes
1
answer
49
views
LMD on Ubuntu 20.04 Server
Despite haviing ClamAV-Daemon installed, LMD / inotify always execute usr/bin/clamscan for scans, rather than using clamd, causes 100% CPU usage spikes.
I've checked the /usr/local/maletect/conf....
- 320
0
votes
0
answers
54
views
What is that .libs directory in the Desktop
What is that .libs directory in the Desktop created by, usually? I've just seen it for the first time. It contains nothing in it, but I am suspicious of it as I haven't run anything on the Desktop ...
- 147
0
votes
0
answers
46
views
How can I ensure that Impress / Powerpoint presentations are virus free?
I use Ubuntu 20.04.
I am aware that viruses exists for all operating systems (Linux included). However, it is rather uncommon to get infected on Ubuntu. Besides that, to avoid any malicious software, ...
- 1,029
0
votes
0
answers
51
views
Finding the unsigned and out-of-tree loaded kernel modules?
I just tried the
cat /proc/sys/kernel/tainted
command and the return value is 12289.
0 1 A module with a non-GPL license has been loaded, this
includes modules with no ...
- 151
1
vote
1
answer
31
views
Question about dual boot
If my Windows gets infected can linux compatible malware pass to Ubuntu? I just wanted to know the method used by the malware since the Ubuntu partition is disabled in Windows.
Thanks in advance.
- 11
0
votes
0
answers
45
views
Does LMD and ClamAV have any packages for sending reports to a monitoring console?
I currently have about forty Ubuntu Servers (mostly 18.04 and 20.04) that I am installing ClamAV and maldetect on so we have at least some monitoring for malware on the systems. What we will likely do ...
- 350
0
votes
2
answers
113
views
Can a virus be installed just by downloading a file?
Let´s assume that I programmatically download a malicious file, e.g. using wget, and try to import in e.g. R or Python as a text file. If it fails, I delete it using rm. There is any chance that my ...
- 145
0
votes
0
answers
31
views
Antivirus in Ubuntu? [duplicate]
I have recently made a switch to Ubuntu from Windows just because Windows is more prone to viruses. We all know Ubuntu isn't also 100% immune to viruses/intruders. Is there any need of installing ...
1
vote
1
answer
415
views
How to stop outgoing brute force attack
I got a email from my ISP that my server tried to access another server via ssh multiple times.
I ran multiple scans on the hole machine and it turns up nothing.
Any idea how I can remove the malware ...
- 13
0
votes
0
answers
187
views
Suspected exploit log_rotari2
Recently performance of my Ubuntu 18 server heavily degraded. I found in process list the following process, which consumes all CPU of my server.
./log_rotari2 --coin monero -o suxsuxsux.com:3333 -u ...
- 101
7
votes
3
answers
5k
views
A crypto-mining process keeps appearing on server
I recently started using a remote Ubuntu server for development and testing machine. However the hosting provider reported a crypto mining process was running and he had to shut down the server.
There ...
- 249
0
votes
1
answer
154
views
How to selectively delete infected files
clamscan found these infected files:
/home/ludvig/.steam/debian-installation/steamapps/common/Proton 6.3/dist/lib64/wine/wordpad.exe: Win.Packed.Pwsx-9885269-0 FOUND
/home/ludvig/.steam/debian-...
- 103
0
votes
0
answers
102
views
Are Windows viruses recognized by AppArmor or SELinux?
I know windows and Linux are completely different environments but are there developers that implement the recognition of windows viruses in AppArmor or SELinux?
I'd like it so you don't have to scan ...
1
vote
0
answers
81
views
How do I know if someone is cryptojacking my system?
I recently installed Ubuntu 20.04 LTS and updated. I found my pc fan running whenever it wanted and also i saw my battery getting draining very fast. Can someone help me solve this issue. I also saw ...
7
votes
1
answer
500
views
What is @!72,27;BDH and @!0,27;BDH?
There are other posts here asking about a mysterious program called @!0,27;BDH.
This program (is it a program?) appeared out of nowhere for me after I upgraded from 20.10 to 21.04 last Friday.
I ...
- 93
2
votes
1
answer
2k
views
How to print the location of malware in the terminal with ClamAV?
When I use
clamscan -r --bell -i /
(scan the whole system, output only when warning appear)
I get this warning in the terminal
LibClamAV Warning: PNG: Unexpected early end-of-file.
How can I get the ...
0
votes
1
answer
543
views
Chrome Consuming a lot of CPU Resources (Possible bg Crypto Miner)
community,
It's been a month and I feel there is some fishy things going on in my chrome ubuntu 20.04. I think there is a possibility of a miner script running in the background.
With hardly 10 open ...
- 1
0
votes
1
answer
45
views
Is downloading a pdf from google drive resource intensive? (firefox)
I tried downloading three pdfs via google drive through firefox.
All of a sudden, my laptop - lenovo ideapad 330s heated up while the pdfs havent finished downloading at all. I downloaded htop to see ...
- 75
1
vote
2
answers
105
views
I possibly installed malware, help please
I was looking for a Twitter app on Ubuntu Software Centre and I downloaded a fake Twitter app from snapcraft. Didn't notice and didn't read the comments before I hit install, like an idiot. The name ...
- 31
0
votes
0
answers
325
views
ClamAV MD5 sum based whitelists (*.fp) don’t work in Ubuntu MATE 20.04.2
Trying to make ClamAV ignore several files. These are almost cryptocoin miners which I do use. Cryptocoin miners get flagged by most antivirus programs for they can be distributed as malware (using ...
- 1
1
vote
0
answers
59
views
What are people using currently for virus and malware checks? [duplicate]
What are people using currently for virus and malware checks? I realize there is far less need for this with Linux than with Windows, but I still prefer wearing a seat belt just moving my car out of ...
- 451
0
votes
1
answer
296
views
Disk Full, Can't login
I'm running Kubuntu 20.10.
I had at least some 5 GB free earlier today. Then apps started acting up. I checked in dolphin, and found I had 0 GB free. I cleared space, at least 2 GB, but it filled up ...
- 125
0
votes
0
answers
48
views
Unknown display font detected on ubuntu
I just suddenly started seeing what is in the screenshot below and I don't know how it came to be. I don't even know if it is a virus or so. Surfed the internet for solutions but found none.
How can ...
- 421
0
votes
1
answer
407
views
Ubuntu / Linux / Windows Virus wrote to my "read only" 20.04.1 Live USB (Twice!) and infected two separate live USB's! How is this possible?
Ok. Hang on to your hats! This is going to sound crazy but I have been attacked by some crazy hacker malware. I believe it started out as a file-less attack on my Widoze 10 Home partition and spread ...
- 11
1
vote
1
answer
238
views
Is rkhunter still required and appropriate? Nothing seems to have been written on it since 2015. Thanks
I want to use my Ubuntu 20.10 Groovy Gorilla desktop for internet banking and making purchases. Good digital hygiene is of course the first defence but i'd like to make sure that rootkits are ...
- 59
1
vote
1
answer
721
views
kinsing miner fix - help needed
Ineed some help removing this kinsing virus (bitcoin miner).
Currently I have this script running every 5 minnutes via a cronjob
sudo kill $(pidof kdevtmpfsi) || True
sudo kill $(pidof kinsing) || ...
- 113
1
vote
1
answer
203
views
What does the Clamtk network setting do?
As mentioned in the question, what does the network setting for clamtk do? It seems that it is not clearly documented in the clamav/clamtk documentations. I have basic knowledge of what is a IP ...
- 23
0
votes
1
answer
157
views
Strange file appeared by itself and wouldn't let me delete. Then later disappeared
Hopefully what happened is normal and it's just my general ignorance regarding these things. I know linux doesn't often get viruses but other strange things have been happening on my system recently, ...
- 23
0
votes
0
answers
189
views
Best log parser for Ubuntu that can parse all the possible information found in a ubuntu system for forensics?
I'm looking for a forensic tool that can help me with parsing all the available information on a system, so any activity that a certain user has done which can be collected needs to be fetched and ...
- 151
2
votes
0
answers
258
views
Malware in www-data crontab
Every so often I see this in my crontab of the www-data user
I know it's malware but i would like to know how this was changed, to prevent this from happening again.
I have already run several tools ...
- 21
0
votes
1
answer
442
views
Weird blow fish icon on my taskbar tray
I have this weird icon on my taskbar tray. I worry that it is some malware or something. I cannot execute it or run it. I tried clicking it but it doesn't do anything.
- 19
2
votes
1
answer
201
views
Launch Nautilus from command line: warnings and errors
I am trying to understand why this suddenly gives me error messages. I have always launched nautilus from the command line and it has always worked. Suddenly I started getting an error message. I ...
- 31
1
vote
0
answers
41
views
Nautilus launches from command, but gives error not seen yesterday
In terminal I launched nautilus and got this error:
Nautilus-Share-Message: Called "net usershare info" but it failed: Failed to execute child process “net” (No such file or directory)
Why ...
- 31
0
votes
0
answers
2k
views
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
Just received this error >>
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
then the disk partition went into READ-Only mode ; also noticed gnome-software was ...
- 21
1
vote
1
answer
139
views
Why it is hard for virus to crack Linux file system although it is so open? [closed]
I've just started my journey in Linux by installing Ubuntu 20.04 LTS, trying to learn about it's file system and working method and faced a question that why a normal user doesn't face any virus issue ...
- 11
0
votes
0
answers
34
views
Keep getting the following message
I am running Ubuntu 20.04. Since reinstalling the operating system (I could not connect to the internet as my ISP kept blocking it). I get the following message
Message reads: potential malware alert....
- 23
0
votes
1
answer
93
views
Null/blank processes on Ubuntu
I am using Ubuntu 20.04 LTS with Mate. Recently I am observing blank processes in System Monitor as shown in the image. Usually, there is only one but sometimes there are a lot as in the image below. ...
- 115
0
votes
1
answer
96
views
Possible malware? - Installed wrong package - Ubuntu 18.04 [duplicate]
Accidentally installed wrong package sudo apt install netplan instead of sudo apt install netplan.io from official Ubuntu repository.
I run Ubuntu 18.04, I wanted to edit DNS servers, but instead I've ...
0
votes
0
answers
202
views
Crypto-mining maleware that disable input and output devices
I recently find my computer monitor sometimes shuts down itself and cannot be wake up by tying on my keyboard or my mouse. I turned off and on the monitor, but it shows 'no input signal'. I changed ...
- 13
0
votes
1
answer
107
views
Does “forked into the background, PID xxxx” means that i executed a malware?
I am a complete newbie in Linux and I was given 2 executable malware files. I used the sudo ./filename command and a message popped up saying "Forked into background, PID XXXX". Does that ...
0
votes
0
answers
78
views
Found a folder named '~' in my home dir. Should I be worried?
I just found a folder named: ~ in my home directory. It had a little red cross on its bottom right corner,like root folder have. It was empty. When I deleted it, I was prompted to enter my login ...
- 15
0
votes
0
answers
374
views
Kill this clamd process running from another user which I never know about
From HTOP
Hi, there is a clamd process running from a user called "tcpdump" I google and found that it's not quite a real user, so I remove that user. However, this process still running and ...
0
votes
1
answer
126
views
Need to check the files that are being uploaded from my system in the background
I've noticed in the System app that sometimes high upload speed, even when there's no application running.
I suspect this could be the work of some malware, and so I'd like to check which IP is being ...
- 498
0
votes
1
answer
131
views
New unknown users appearing on ubuntu, virus?
there are these two users periodically appearing in my ubuntu system ('jicofo','jvb') I have deleted them twice (in 19.10) but they reappeared again, so I thought I'd look into it and turns out they ...
0
votes
1
answer
165
views
ClamTk found Trojan.Generic-6888382 in Javascript directory
TROJAN IN Ubuntu 20.04 LTS - JAVA SCRIPT
I run ClamTK and it finds Trojan.Generic-6888382 in usr/share/javascript/jquery-ui.min
I delete it, but then it's there again. I quarantine it, but it's there ...
- 21
0
votes
1
answer
51
views
Ubuntu asked me to update but is not connected to the internet and hasn't been used for weeks
I'm sorry if this sounds dumb. I'm new to linux and ubuntu. I like to play around with it sometimes. Just now i booted up ubuntu from an usb stick. I use a wired connection and ubuntu has airplane ...
- 1
0
votes
2
answers
166
views
Is snap verified by Ubuntu SnapCraft Team?
Is snap verified by Ubuntu SnapCraft Team similar like Apple in Appstore?
Verification about: It contains malware / spyware / virus / stealing information / unnecessary permission usage or not.
- 113