Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

"Malware" is a portmanteau of "malicious" and "software"

Common forms of malware include:

  • Botnet clients, which grant the malware author some degree of control over the compromised operating system and are generally employed in sending spam e-mail and may be rented out to perform DDoS attacks.
  • Data exfiltrators, which collect and transmit data about the computer they reside on back to the creator. These are commonly used to target login and account details for financial, social networking, and gaming websites.
  • Rogue Utility Applications, which attempt to use scare tactics in order to entice the computer's user to purchase the "full version" of the Rogue Utility.
  • Adware, which causes advertisements to appear on the user's desktop, in webpages, or elsewhere.
  • Rootkits, which attempt to conceal the presence of both the root kit and (usually) an accompanying piece of malware from another category from standard system tools and diagnostic utilities.
333 questions
0
votes
1 answer

Filesystem on VM slowly fills itself every tho hours and then suddenly returns to its initial state

Let me start saying I'm not a sysadmin, I'm a php programmer with few knowledge of unix systems, so, excuse me if I say some nonsense. I'm managing this VM with a few Wordpress installed and, in searching of what is causing some front-end bugs, I…
0
votes
2 answers

Ransomware infection: What to do

t seems that somehow our domain computers have been infected by rasomware, turning files into encrypted files ending with .crypted. Lots of file have been changed and we do have back up. At the same time, scanning for actual malware/virus/trojan…
Jason Staples
  • 117
  • 1
  • 1
  • 9
0
votes
1 answer

How to diagnose process at 100% CPU without being able to shell in?

Given an Ubuntu 14.04 server setup on a popular VPS provider hosting a single website with Nginx, Apache and WordPress / PHP, after starting the server it works fine for a while. Days later the VPS provider shows the server as pegged at 100% CPU…
sean2078
  • 111
  • 2
0
votes
1 answer

How can I identify applications or processes using thunder protocol in the network

For the last one week we have been having performance issues with our internet connection. The only thing that i know of that has changed with in this period is that I have upgraded several desktop OS from ubuntu-mate 14.04 to ubuntu-mate 16.04.…
0
votes
2 answers

Inspecting TLS/SSL passing in/out of a network without specialised device?

At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device. The motive is to increase the barrier for undetected malware and…
Stilez
  • 714
  • 7
  • 15
0
votes
1 answer

Linux Maldetect Not Sending Email Reports

I've set Linux Malware Detect to send me emails of the reports it generates, but haven't received a single one even though it has produced several reports. Relevant maldet settings /usr/local/maldetect/conf.maldet…
GTS Joe
  • 199
  • 2
  • 10
0
votes
1 answer

Errors installing Linux Malware Detector on Ubuntu 14.04 LTS

Upon running ./install .sh, I get... ln: failed to create symbolic link ‘/usr/local/sbin/maldet’: No such file or directory ln: failed to create symbolic link ‘/usr/local/sbin/lmd’: No such file or directory then, update-rc.d: warning:…
forresttales
  • 63
  • 1
  • 6
0
votes
2 answers

Find out which PHP-Script starts Apache2-process

I would like to know how you find out which php-scripts are starting apache2-processes, which are causing high load. It seems that one user is infected with malware (php-shell). LMD (maldet/maldetect) does not find the file, but there are…
MyFault
  • 913
  • 3
  • 15
  • 36
0
votes
2 answers

Ads by jabuticaba in all browsers

Recently we got a user who had some malware on his machine -- we've run our McAfee VirusScan Enterprise software, malware bytes anti-malware, combo-fix, adwcleaner and hijack this just to name a few applications. I've also combed through his…
SomeITGuy
  • 17
  • 1
0
votes
1 answer

Strange process running

I just mentioned that one user starts a process which is called "httpd". 31712 ftp_johndoe 20 0 35988 8828 1460 S 14.0 0.0 1h50:31 httpd 28616 ftp_johndoe 20 0 5304M 43936 35080 S 4.0 0.2 0:02.72 /usr/bin/php5-cgi -c…
MyFault
  • 913
  • 3
  • 15
  • 36
0
votes
1 answer

SCEP: imitate potential threat in both live and regular scanner to inspect logs

I am doing some powershell stuff to parse a few logs at work. I would also like to collect some information from the SCEP logs. I find the amount of logs available as well as the different locations in which they are stored a bit overwhelming to say…
Andrew Tobey
  • 253
  • 1
  • 2
  • 8
0
votes
1 answer

SED multiline recursive find and replace

I have a large number of sites with the same bit of php inserted in all files that contain footer in their filenames. //###==### malicious code //###==### How to use SED or another command to remove all these in all files?
Adamz
  • 21
  • 3
0
votes
1 answer

How to remove crypto-ransomware on my network domain

Today some computer on my domain got infected with crypto-ransomware and have infected some folders on file server that only some computers on network have access to. So I presume one or more of five computers that can access to that folders got…
Davidenko
  • 101
  • 2
0
votes
2 answers

My servers are overloaded with random GET requests. Why?

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET…
jldugger
  • 14,342
  • 20
  • 77
  • 129
0
votes
1 answer

Automatic installation of DbSecurityspt folder

We have an Amazon EC2 instance. The folder DbSecurityspt gets automatically installed in c:/ProgramFiles and the associated service also starts automatically. Removing them, installs them again the next day. After googling, it was found be a trojan.…