Questions tagged [malware]

Questions relating to malicious software

Filter by
Sorted by
Tagged with
22 votes
5 answers
5k views

Can windows viruses affect my encrypted linux partition on the same disk?

Can Windows viruses affect my encrypted Linux partition on the same disk? I just want to use Windows but I am concerned.
user avatar
  • 257
2 votes
1 answer
37 views

pmproxy using 100% CPU

For a couple days now, I notice a process called pmproxy using 100% CPU on bootup and stays at 100%. I kill the process and it restarts a couple seconds later. I renamed the folder /usr/lib/pcp and ...
user avatar
3 votes
0 answers
87 views

Rkhunter still relevant in 2022?

I tried using the RKHunter 1.4.6 (http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz) in Ubuntu20.04 , it is around 4 years old , running it did not find any ...
user avatar
  • 31
0 votes
1 answer
49 views

LMD on Ubuntu 20.04 Server

Despite haviing ClamAV-Daemon installed, LMD / inotify always execute usr/bin/clamscan for scans, rather than using clamd, causes 100% CPU usage spikes. I've checked the /usr/local/maletect/conf....
user avatar
0 votes
0 answers
54 views

What is that .libs directory in the Desktop

What is that .libs directory in the Desktop created by, usually? I've just seen it for the first time. It contains nothing in it, but I am suspicious of it as I haven't run anything on the Desktop ...
user avatar
0 votes
0 answers
46 views

How can I ensure that Impress / Powerpoint presentations are virus free?

I use Ubuntu 20.04. I am aware that viruses exists for all operating systems (Linux included). However, it is rather uncommon to get infected on Ubuntu. Besides that, to avoid any malicious software, ...
user avatar
  • 1,029
0 votes
0 answers
51 views

Finding the unsigned and out-of-tree loaded kernel modules?

I just tried the cat /proc/sys/kernel/tainted command and the return value is 12289. 0 1 A module with a non-GPL license has been loaded, this includes modules with no ...
user avatar
1 vote
1 answer
31 views

Question about dual boot

If my Windows gets infected can linux compatible malware pass to Ubuntu? I just wanted to know the method used by the malware since the Ubuntu partition is disabled in Windows. Thanks in advance.
user avatar
0 votes
0 answers
45 views

Does LMD and ClamAV have any packages for sending reports to a monitoring console?

I currently have about forty Ubuntu Servers (mostly 18.04 and 20.04) that I am installing ClamAV and maldetect on so we have at least some monitoring for malware on the systems. What we will likely do ...
user avatar
  • 350
0 votes
2 answers
113 views

Can a virus be installed just by downloading a file?

Let´s assume that I programmatically download a malicious file, e.g. using wget, and try to import in e.g. R or Python as a text file. If it fails, I delete it using rm. There is any chance that my ...
user avatar
0 votes
0 answers
31 views

Antivirus in Ubuntu? [duplicate]

I have recently made a switch to Ubuntu from Windows just because Windows is more prone to viruses. We all know Ubuntu isn't also 100% immune to viruses/intruders. Is there any need of installing ...
user avatar
1 vote
1 answer
415 views

How to stop outgoing brute force attack

I got a email from my ISP that my server tried to access another server via ssh multiple times. I ran multiple scans on the hole machine and it turns up nothing. Any idea how I can remove the malware ...
user avatar
0 votes
0 answers
187 views

Suspected exploit log_rotari2

Recently performance of my Ubuntu 18 server heavily degraded. I found in process list the following process, which consumes all CPU of my server. ./log_rotari2 --coin monero -o suxsuxsux.com:3333 -u ...
user avatar
7 votes
3 answers
5k views

A crypto-mining process keeps appearing on server

I recently started using a remote Ubuntu server for development and testing machine. However the hosting provider reported a crypto mining process was running and he had to shut down the server. There ...
user avatar
0 votes
1 answer
154 views

How to selectively delete infected files

clamscan found these infected files: /home/ludvig/.steam/debian-installation/steamapps/common/Proton 6.3/dist/lib64/wine/wordpad.exe: Win.Packed.Pwsx-9885269-0 FOUND /home/ludvig/.steam/debian-...
user avatar
  • 103
0 votes
0 answers
102 views

Are Windows viruses recognized by AppArmor or SELinux?

I know windows and Linux are completely different environments but are there developers that implement the recognition of windows viruses in AppArmor or SELinux? I'd like it so you don't have to scan ...
user avatar
1 vote
0 answers
81 views

How do I know if someone is cryptojacking my system?

I recently installed Ubuntu 20.04 LTS and updated. I found my pc fan running whenever it wanted and also i saw my battery getting draining very fast. Can someone help me solve this issue. I also saw ...
user avatar
7 votes
1 answer
500 views

What is @!72,27;BDH and @!0,27;BDH?

There are other posts here asking about a mysterious program called @!0,27;BDH. This program (is it a program?) appeared out of nowhere for me after I upgraded from 20.10 to 21.04 last Friday. I ...
user avatar
  • 93
2 votes
1 answer
2k views

How to print the location of malware in the terminal with ClamAV?

When I use clamscan -r --bell -i / (scan the whole system, output only when warning appear) I get this warning in the terminal LibClamAV Warning: PNG: Unexpected early end-of-file. How can I get the ...
user avatar
0 votes
1 answer
543 views

Chrome Consuming a lot of CPU Resources (Possible bg Crypto Miner)

community, It's been a month and I feel there is some fishy things going on in my chrome ubuntu 20.04. I think there is a possibility of a miner script running in the background. With hardly 10 open ...
user avatar
0 votes
1 answer
45 views

Is downloading a pdf from google drive resource intensive? (firefox)

I tried downloading three pdfs via google drive through firefox. All of a sudden, my laptop - lenovo ideapad 330s heated up while the pdfs havent finished downloading at all. I downloaded htop to see ...
user avatar
  • 75
1 vote
2 answers
105 views

I possibly installed malware, help please

I was looking for a Twitter app on Ubuntu Software Centre and I downloaded a fake Twitter app from snapcraft. Didn't notice and didn't read the comments before I hit install, like an idiot. The name ...
user avatar
  • 31
0 votes
0 answers
325 views

ClamAV MD5 sum based whitelists (*.fp) don’t work in Ubuntu MATE 20.04.2

Trying to make ClamAV ignore several files. These are almost cryptocoin miners which I do use. Cryptocoin miners get flagged by most antivirus programs for they can be distributed as malware (using ...
user avatar
  • 1
1 vote
0 answers
59 views

What are people using currently for virus and malware checks? [duplicate]

What are people using currently for virus and malware checks? I realize there is far less need for this with Linux than with Windows, but I still prefer wearing a seat belt just moving my car out of ...
user avatar
0 votes
1 answer
296 views

Disk Full, Can't login

I'm running Kubuntu 20.10. I had at least some 5 GB free earlier today. Then apps started acting up. I checked in dolphin, and found I had 0 GB free. I cleared space, at least 2 GB, but it filled up ...
user avatar
  • 125
0 votes
0 answers
48 views

Unknown display font detected on ubuntu

I just suddenly started seeing what is in the screenshot below and I don't know how it came to be. I don't even know if it is a virus or so. Surfed the internet for solutions but found none. How can ...
user avatar
  • 421
0 votes
1 answer
407 views

Ubuntu / Linux / Windows Virus wrote to my "read only" 20.04.1 Live USB (Twice!) and infected two separate live USB's! How is this possible?

Ok. Hang on to your hats! This is going to sound crazy but I have been attacked by some crazy hacker malware. I believe it started out as a file-less attack on my Widoze 10 Home partition and spread ...
user avatar
1 vote
1 answer
238 views

Is rkhunter still required and appropriate? Nothing seems to have been written on it since 2015. Thanks

I want to use my Ubuntu 20.10 Groovy Gorilla desktop for internet banking and making purchases. Good digital hygiene is of course the first defence but i'd like to make sure that rootkits are ...
user avatar
  • 59
1 vote
1 answer
721 views

kinsing miner fix - help needed

Ineed some help removing this kinsing virus (bitcoin miner). Currently I have this script running every 5 minnutes via a cronjob sudo kill $(pidof kdevtmpfsi) || True sudo kill $(pidof kinsing) || ...
user avatar
1 vote
1 answer
203 views

What does the Clamtk network setting do?

As mentioned in the question, what does the network setting for clamtk do? It seems that it is not clearly documented in the clamav/clamtk documentations. I have basic knowledge of what is a IP ...
user avatar
  • 23
0 votes
1 answer
157 views

Strange file appeared by itself and wouldn't let me delete. Then later disappeared

Hopefully what happened is normal and it's just my general ignorance regarding these things. I know linux doesn't often get viruses but other strange things have been happening on my system recently, ...
user avatar
0 votes
0 answers
189 views

Best log parser for Ubuntu that can parse all the possible information found in a ubuntu system for forensics?

I'm looking for a forensic tool that can help me with parsing all the available information on a system, so any activity that a certain user has done which can be collected needs to be fetched and ...
user avatar
2 votes
0 answers
258 views

Malware in www-data crontab

Every so often I see this in my crontab of the www-data user I know it's malware but i would like to know how this was changed, to prevent this from happening again. I have already run several tools ...
user avatar
  • 21
0 votes
1 answer
442 views

Weird blow fish icon on my taskbar tray

I have this weird icon on my taskbar tray. I worry that it is some malware or something. I cannot execute it or run it. I tried clicking it but it doesn't do anything.
user avatar
2 votes
1 answer
201 views

Launch Nautilus from command line: warnings and errors

I am trying to understand why this suddenly gives me error messages. I have always launched nautilus from the command line and it has always worked. Suddenly I started getting an error message. I ...
user avatar
  • 31
1 vote
0 answers
41 views

Nautilus launches from command, but gives error not seen yesterday

In terminal I launched nautilus and got this error: Nautilus-Share-Message: Called "net usershare info" but it failed: Failed to execute child process “net” (No such file or directory) Why ...
user avatar
  • 31
0 votes
0 answers
2k views

bash: cannot set terminal process group (-1): Inappropriate ioctl for device

Just received this error >> bash: cannot set terminal process group (-1): Inappropriate ioctl for device then the disk partition went into READ-Only mode ; also noticed gnome-software was ...
user avatar
1 vote
1 answer
139 views

Why it is hard for virus to crack Linux file system although it is so open? [closed]

I've just started my journey in Linux by installing Ubuntu 20.04 LTS, trying to learn about it's file system and working method and faced a question that why a normal user doesn't face any virus issue ...
user avatar
  • 11
0 votes
0 answers
34 views

Keep getting the following message

I am running Ubuntu 20.04. Since reinstalling the operating system (I could not connect to the internet as my ISP kept blocking it). I get the following message Message reads: potential malware alert....
user avatar
0 votes
1 answer
93 views

Null/blank processes on Ubuntu

I am using Ubuntu 20.04 LTS with Mate. Recently I am observing blank processes in System Monitor as shown in the image. Usually, there is only one but sometimes there are a lot as in the image below. ...
user avatar
  • 115
0 votes
1 answer
96 views

Possible malware? - Installed wrong package - Ubuntu 18.04 [duplicate]

Accidentally installed wrong package sudo apt install netplan instead of sudo apt install netplan.io from official Ubuntu repository. I run Ubuntu 18.04, I wanted to edit DNS servers, but instead I've ...
user avatar
0 votes
0 answers
202 views

Crypto-mining maleware that disable input and output devices

I recently find my computer monitor sometimes shuts down itself and cannot be wake up by tying on my keyboard or my mouse. I turned off and on the monitor, but it shows 'no input signal'. I changed ...
user avatar
  • 13
0 votes
1 answer
107 views

Does “forked into the background, PID xxxx” means that i executed a malware?

I am a complete newbie in Linux and I was given 2 executable malware files. I used the sudo ./filename command and a message popped up saying "Forked into background, PID XXXX". Does that ...
user avatar
0 votes
0 answers
78 views

Found a folder named '~' in my home dir. Should I be worried?

I just found a folder named: ~ in my home directory. It had a little red cross on its bottom right corner,like root folder have. It was empty. When I deleted it, I was prompted to enter my login ...
user avatar
  • 15
0 votes
0 answers
374 views

Kill this clamd process running from another user which I never know about

From HTOP Hi, there is a clamd process running from a user called "tcpdump" I google and found that it's not quite a real user, so I remove that user. However, this process still running and ...
user avatar
0 votes
1 answer
126 views

Need to check the files that are being uploaded from my system in the background

I've noticed in the System app that sometimes high upload speed, even when there's no application running. I suspect this could be the work of some malware, and so I'd like to check which IP is being ...
user avatar
  • 498
0 votes
1 answer
131 views

New unknown users appearing on ubuntu, virus?

there are these two users periodically appearing in my ubuntu system ('jicofo','jvb') I have deleted them twice (in 19.10) but they reappeared again, so I thought I'd look into it and turns out they ...
user avatar
0 votes
1 answer
165 views

ClamTk found Trojan.Generic-6888382 in Javascript directory

TROJAN IN Ubuntu 20.04 LTS - JAVA SCRIPT I run ClamTK and it finds Trojan.Generic-6888382 in usr/share/javascript/jquery-ui.min I delete it, but then it's there again. I quarantine it, but it's there ...
user avatar
0 votes
1 answer
51 views

Ubuntu asked me to update but is not connected to the internet and hasn't been used for weeks

I'm sorry if this sounds dumb. I'm new to linux and ubuntu. I like to play around with it sometimes. Just now i booted up ubuntu from an usb stick. I use a wired connection and ubuntu has airplane ...
user avatar
0 votes
2 answers
166 views

Is snap verified by Ubuntu SnapCraft Team?

Is snap verified by Ubuntu SnapCraft Team similar like Apple in Appstore? Verification about: It contains malware / spyware / virus / stealing information / unnecessary permission usage or not.
user avatar
  • 113

1
2 3 4 5
10