As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [malware]

Questions relating to malicious software

Filter by
Sorted by
Tagged with
0 votes
1 answer
29 views

Is it possible to see what processes did last mounted USB device?

Is it possible to see what last mounted USB device? I am afraid, that last device infected my ubuntu machine and want to find out something about that device.
Karolis's user avatar
  • 29
0 votes
0 answers
69 views

Ubuntu 23.04 clamtk: libjson-c.so.3: cannot open shared object file: No such file or directory

I cant use the program for years now. What is wrong here?
jac's user avatar
  • 1
2 votes
0 answers
298 views

BLACKLOTUS UEFI virus: windows cannot avoid but how about Ubuntu?

Windows is facing a serious threat but what about Ubuntu? Is there any way to avoid UEFI in the boot process or not be affected by BLACKLOTUS? https://www.schneier.com/blog/archives/2023/03/blacklotus-...
serros's user avatar
  • 37
0 votes
1 answer
150 views

Linux Malware Detection - Malware in LMD folder found

I recently ran a full scan of my Ubuntu 22.04 LTS system and maldet reported these two files: maldet(3692653): {quar} malware quarantined from '/home/davids/LMD/maldetect-current/maldetect-1.6.4/files/...
sedsiv's user avatar
  • 133
1 vote
1 answer
45 views

Compromised Ubuntu? Weird unauthorised iso file downloads and download attempts

I noticed 2 failed attempts at downloading an iso file in my Downloads, that were attempted without my knowing. It happened while I was using the computer (attempt time 10:06, screenshot 1). The ...
Grace Pine's user avatar
2 votes
1 answer
241 views

How do I know if Ubuntu 22.04 has any virus?

I have a Windows / Ubuntu 22.04 dual boot. I get screen artifacts as shown below. At that moment, what I restarted Ubuntu. When it turned on, it no longer appeared and, until now all the applications ...
AngeM's user avatar
  • 23
0 votes
0 answers
190 views

kdevtmpfsi using the entire CPU

I noticed the cpu on ubuntu is 100% used by a process named kdevtmpfsi Anyone know what this is -is it malware? In /var/spool/cron/crontabs/www-data i came across the following cron job: # DO NOT EDIT ...
adam78's user avatar
  • 121
1 vote
1 answer
54 views

I possibly installed a malware by a misspelled java installation command in the terminal

I was trying to download java, more specifically, JDK version 16. The right command was sudo apt install openjdk-16-jdk, but I end up typing sudo apt install open-jdk-11 instead, the funny thing is ...
HaveMercy's user avatar
0 votes
0 answers
65 views

Files Unexpectedly Identified as Trojans by ClamAV

ClamAV has produced some unexpected results from a recent scan: Are the files in libxkbcommon and node_modules really trojans and exploits, or is this an example of Clam not doing what it's supposed ...
001121100's user avatar
0 votes
0 answers
104 views

my homedisk erased, is this malware or a systemfault?

After trying to save a spreadsheet, LibreOffice was hanging and could not be used anymore. I recently installed 20.045 so I decided to reinstall it. I first made an rsync of my homedirectory which is ...
Newbie's user avatar
  • 721
1 vote
0 answers
48 views

Is this system affected by CVE-2019-7304?

I am analyzing a system that since a month shows two new users in the login screen. After some research I stumbled over the exploit of snap: CVE-2019-7304 I checked the passwd file and found a new ...
rayon's user avatar
  • 111
0 votes
0 answers
462 views

rkhunter warnings

Hi I just ran rkhunters and got a lot of warnings which are not the first ones I found the first time a I ran it. I'll drop here the results to see if someone can help me and tell tell me if they are ...
Dcodewin's user avatar
1 vote
1 answer
182 views

chkrootkit says "grep --color=auto INFECTED," what should I do?

I just installed and ran chkrootkit for the first time and when I ran sudo chkrootkit | grep INFECTED, it returned ![user] 21342 pts/0 grep --color=auto INFECTED I'm a complete novice at this and ...
galleon's user avatar
  • 11
0 votes
0 answers
94 views

Clamscan cannot remove 'Read Only' viruses in /media/user/Windows

I ran a clamscan -r -i --remove / on my Ubuntu 22.04, which is installed alongside Windows 10 on my computer, and it gave me the following results: /media/<me>/Windows/Program Files/Common Files/...
Falcon27's user avatar
0 votes
0 answers
38 views

key strokes take a long time to register, ubuntu 16.04, ubuntu 18.04, etc

No matter what Ubuntu version or kernel version, some time after install it comes to the point where keystrokes take a long time to register. Sometimes it misses a character or duplicates a character,...
two4two's user avatar
  • 11
0 votes
1 answer
140 views

How to use wine with more security?

This question may sound duplicate but please read. I am trying to make a cross compiled application. So I would like to try mingw64. But while installing it I found that it requires wine. I have heard ...
Sohan Arafat's user avatar
0 votes
1 answer
163 views

What is the Generic Drive that keeps beeping on and off

Symptoms: Once booted and logged in: Computer beeps (same as attaching an external USB drive) then beeps (same as detaching an external USB drive). Frequent. Erratic. (Annoying. Worrisome: is ...
TLMystic's user avatar
0 votes
0 answers
346 views

Missing Inotify Pidfile Can't Start Maldet Service

I am running Ubuntu 20.04 on both my test and prod servers and I have exactly the same configs for maldet 1.6.4: /usr/local/maldet/conf.maldet /usr/local/maldetect/internals/functions /lib/systemd/...
nightwatch's user avatar
0 votes
0 answers
57 views

Ubuntu hogging internet data even when idle

Ubuntu 20.04. I just connected my Ubuntu laptop that has negligible amount of apps installed to my WiFi. It's the only connected device to the router. My router is blinking rapidly, it does that when ...
Vin Raghav's user avatar
1 vote
0 answers
43 views

Possible windows virus infection?

Our IT team reported that a virus scan they did against an ubuntu server came back with: /sys/kernel/boot_params/data: Win.Trojan.Blackhole-36 FOUND When I looked at that file I can see text like ^...
Danbuntu's user avatar
0 votes
0 answers
163 views

New User needs help removing root kit virus

I clicked on a PUP pretending to be Norton and then subsequently installed Malware/Trojan. This virus overwrites the firmware of your router and redirects your DNS (doing a hardware reset does not ...
Peter's user avatar
  • 1
25 votes
5 answers
6k views

Can windows viruses affect my encrypted linux partition on the same disk?

Can Windows viruses affect my encrypted Linux partition on the same disk? I just want to use Windows but I am concerned.
anon's user avatar
  • 317
2 votes
1 answer
325 views

pmproxy using 100% CPU

For a couple days now, I notice a process called pmproxy using 100% CPU on bootup and stays at 100%. I kill the process and it restarts a couple seconds later. I renamed the folder /usr/lib/pcp and ...
FlyingFish's user avatar
6 votes
0 answers
365 views

Rkhunter still relevant in 2022?

I tried using the RKHunter 1.4.6 (http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz) in Ubuntu20.04 , it is around 4 years old , running it did not find any ...
rkte's user avatar
  • 61
0 votes
1 answer
267 views

LMD on Ubuntu 20.04 Server

Despite haviing ClamAV-Daemon installed, LMD / inotify always execute usr/bin/clamscan for scans, rather than using clamd, causes 100% CPU usage spikes. I've checked the /usr/local/maletect/conf....
nightwatch's user avatar
0 votes
0 answers
69 views

What is that .libs directory in the Desktop

What is that .libs directory in the Desktop created by, usually? I've just seen it for the first time. It contains nothing in it, but I am suspicious of it as I haven't run anything on the Desktop ...
Example person's user avatar
0 votes
0 answers
94 views

How can I ensure that Impress / Powerpoint presentations are virus free?

I use Ubuntu 20.04. I am aware that viruses exists for all operating systems (Linux included). However, it is rather uncommon to get infected on Ubuntu. Besides that, to avoid any malicious software, ...
matandked's user avatar
  • 1,079
3 votes
0 answers
394 views

Finding the unsigned and out-of-tree loaded kernel modules?

I just tried the cat /proc/sys/kernel/tainted command and the return value is 12289. 0 1 A module with a non-GPL license has been loaded, this includes modules with no ...
OneAndOnly's user avatar
1 vote
1 answer
35 views

Question about dual boot

If my Windows gets infected can linux compatible malware pass to Ubuntu? I just wanted to know the method used by the malware since the Ubuntu partition is disabled in Windows. Thanks in advance.
denisPlay's user avatar
0 votes
0 answers
110 views

Does LMD and ClamAV have any packages for sending reports to a monitoring console?

I currently have about forty Ubuntu Servers (mostly 18.04 and 20.04) that I am installing ClamAV and maldetect on so we have at least some monitoring for malware on the systems. What we will likely do ...
S. Nixon's user avatar
  • 372
0 votes
2 answers
474 views

Can a virus be installed just by downloading a file?

Let´s assume that I programmatically download a malicious file, e.g. using wget, and try to import in e.g. R or Python as a text file. If it fails, I delete it using rm. There is any chance that my ...
user3091668's user avatar
0 votes
0 answers
31 views

Antivirus in Ubuntu? [duplicate]

I have recently made a switch to Ubuntu from Windows just because Windows is more prone to viruses. We all know Ubuntu isn't also 100% immune to viruses/intruders. Is there any need of installing ...
Suryanshu Dinkar's user avatar
1 vote
1 answer
1k views

How to stop outgoing brute force attack

I got a email from my ISP that my server tried to access another server via ssh multiple times. I ran multiple scans on the hole machine and it turns up nothing. Any idea how I can remove the malware ...
Marvin S.'s user avatar
0 votes
0 answers
233 views

Suspected exploit log_rotari2

Recently performance of my Ubuntu 18 server heavily degraded. I found in process list the following process, which consumes all CPU of my server. ./log_rotari2 --coin monero -o suxsuxsux.com:3333 -u ...
Boris Zinchenko's user avatar
7 votes
3 answers
6k views

A crypto-mining process keeps appearing on server

I recently started using a remote Ubuntu server for development and testing machine. However the hosting provider reported a crypto mining process was running and he had to shut down the server. There ...
Simple Fellow's user avatar
0 votes
1 answer
290 views

How to selectively delete infected files

clamscan found these infected files: /home/ludvig/.steam/debian-installation/steamapps/common/Proton 6.3/dist/lib64/wine/wordpad.exe: Win.Packed.Pwsx-9885269-0 FOUND /home/ludvig/.steam/debian-...
ludz's user avatar
  • 103
0 votes
0 answers
206 views

Are Windows viruses recognized by AppArmor or SELinux?

I know windows and Linux are completely different environments but are there developers that implement the recognition of windows viruses in AppArmor or SELinux? I'd like it so you don't have to scan ...
Galen Marek's user avatar
1 vote
0 answers
109 views

How do I know if someone is cryptojacking my system?

I recently installed Ubuntu 20.04 LTS and updated. I found my pc fan running whenever it wanted and also i saw my battery getting draining very fast. Can someone help me solve this issue. I also saw ...
Srinivasa M S's user avatar
8 votes
1 answer
1k views

What is @!72,27;BDH and @!0,27;BDH?

There are other posts here asking about a mysterious program called @!0,27;BDH. This program (is it a program?) appeared out of nowhere for me after I upgraded from 20.10 to 21.04 last Friday. I ...
Jorge's user avatar
  • 103
2 votes
1 answer
4k views

How to print the location of malware in the terminal with ClamAV?

When I use clamscan -r --bell -i / (scan the whole system, output only when warning appear) I get this warning in the terminal LibClamAV Warning: PNG: Unexpected early end-of-file. How can I get the ...
Lautaro Salvatore's user avatar
0 votes
1 answer
809 views

Chrome Consuming a lot of CPU Resources (Possible bg Crypto Miner)

community, It's been a month and I feel there is some fishy things going on in my chrome ubuntu 20.04. I think there is a possibility of a miner script running in the background. With hardly 10 open ...
Bisakh Mondal's user avatar
0 votes
1 answer
66 views

Is downloading a pdf from google drive resource intensive? (firefox)

I tried downloading three pdfs via google drive through firefox. All of a sudden, my laptop - lenovo ideapad 330s heated up while the pdfs havent finished downloading at all. I downloaded htop to see ...
Blank's user avatar
  • 75
1 vote
2 answers
156 views

I possibly installed malware, help please

I was looking for a Twitter app on Ubuntu Software Centre and I downloaded a fake Twitter app from snapcraft. Didn't notice and didn't read the comments before I hit install, like an idiot. The name ...
tmrrr's user avatar
  • 31
0 votes
0 answers
473 views

ClamAV MD5 sum based whitelists (*.fp) don’t work in Ubuntu MATE 20.04.2

Trying to make ClamAV ignore several files. These are almost cryptocoin miners which I do use. Cryptocoin miners get flagged by most antivirus programs for they can be distributed as malware (using ...
Cigydd's user avatar
  • 1
1 vote
0 answers
59 views

What are people using currently for virus and malware checks? [duplicate]

What are people using currently for virus and malware checks? I realize there is far less need for this with Linux than with Windows, but I still prefer wearing a seat belt just moving my car out of ...
Kevin Berry's user avatar
0 votes
1 answer
1k views

Disk Full, Can't login

I'm running Kubuntu 20.10. I had at least some 5 GB free earlier today. Then apps started acting up. I checked in dolphin, and found I had 0 GB free. I cleared space, at least 2 GB, but it filled up ...
007's user avatar
  • 145
0 votes
0 answers
62 views

Unknown display font detected on ubuntu

I just suddenly started seeing what is in the screenshot below and I don't know how it came to be. I don't even know if it is a virus or so. Surfed the internet for solutions but found none. How can ...
FOBABS's user avatar
  • 421
0 votes
1 answer
621 views

Ubuntu / Linux / Windows Virus wrote to my "read only" 20.04.1 Live USB (Twice!) and infected two separate live USB's! How is this possible?

Ok. Hang on to your hats! This is going to sound crazy but I have been attacked by some crazy hacker malware. I believe it started out as a file-less attack on my Widoze 10 Home partition and spread ...
Christopher's user avatar
1 vote
1 answer
356 views

Is rkhunter still required and appropriate? Nothing seems to have been written on it since 2015. Thanks

I want to use my Ubuntu 20.10 Groovy Gorilla desktop for internet banking and making purchases. Good digital hygiene is of course the first defence but i'd like to make sure that rootkits are ...
Heafod's user avatar
  • 77
1 vote
1 answer
886 views

kinsing miner fix - help needed

Ineed some help removing this kinsing virus (bitcoin miner). Currently I have this script running every 5 minnutes via a cronjob sudo kill $(pidof kdevtmpfsi) || True sudo kill $(pidof kinsing) || ...
Dean Van Greunen's user avatar

1
2 3 4 5
9