Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

"Malware" is a portmanteau of "malicious" and "software"

Common forms of malware include:

  • Botnet clients, which grant the malware author some degree of control over the compromised operating system and are generally employed in sending spam e-mail and may be rented out to perform DDoS attacks.
  • Data exfiltrators, which collect and transmit data about the computer they reside on back to the creator. These are commonly used to target login and account details for financial, social networking, and gaming websites.
  • Rogue Utility Applications, which attempt to use scare tactics in order to entice the computer's user to purchase the "full version" of the Rogue Utility.
  • Adware, which causes advertisements to appear on the user's desktop, in webpages, or elsewhere.
  • Rootkits, which attempt to conceal the presence of both the root kit and (usually) an accompanying piece of malware from another category from standard system tools and diagnostic utilities.
333 questions
0
votes
0 answers

How to identify application that is generating ICMP echo requests on Windows 10?

My company security team has informed me that my workstation is pinging some "blacklisted" IP addresses. The enterprise security tool reporting this information sits in place of the usual Windows firewall, but it seems it is unable to tell which…
0
votes
1 answer

Best practices for malware scanning on Ubuntu servers in production

There are multiple malware/rootkit scanning packages for ubuntu such as clamAV, rkhunter etc. I know how to use them manually but for multiple servers in production environment I could not find a solution which scans the servers daily and send…
Niro
  • 1,401
  • 4
  • 20
  • 36
0
votes
1 answer

SPAM after activating WordPress plugin on Linux VPS

After activating a plugin I received an email that I had never recived before. What kind of miscellaneous code it might be? it's a coincidence? I received an email to my account Gmail that I never used on my VPS (not sure) and I am sure that I never…
phtshw
  • 1
0
votes
2 answers

Has anyone seen gvtlsysguard.exe in the wild?

has anyone seen this file before "gvtlsysguard.exe" and have any idea what it is? This weekend, I noticed one of my users had this file in their user profile's Local Settings folder and somehow they wrote a registry key to…
Jacob
  • 443
  • 1
  • 9
  • 23
0
votes
1 answer

Update From Debian 10 to Debian 11 Gone Wrong

I just upgrade from Debian 10 to Debian 11 using these instructions. Everything seems to have worked smoothly, except maldet is failing. This is the the error: maldet[2117]: maldet(2117): {mon} kernel does not support inotify(), aborting systemd[1]:…
Maestro223
  • 203
  • 2
  • 13
0
votes
1 answer

Is there a (forensic) way to list past events/actions of a certain *.exe malware program (PUP-Proxygate, possibly a Trojan)?

There is a folder with suspicious *.exe files on a Win 10 PC, and there are (external) protocols of potentially unlawful actions coming from that PC at a certain time in the past. The first suspicious action was network traffic to a sinkhole IP…
David.P
  • 119
  • 6
0
votes
1 answer

Suspicious users with numbers are devouring entire CPU

On my test server which I have docker-run gitlab-ce, redis server and some other important services, I noticed I have an uninvited guest, kdevtmpfsi. I tried everything proposed by the community but I see kind of intelligence in this one. I runs…
0
votes
2 answers

How to restrict access between folders on the same virtual host

We plan to host WordPress Blog and an Ecommerce store on the same domain, so the URL's will look like this: example.com <--- Magento Store example.com/blog/ <--- WordPress Blog Our main concern is the security of the e-commerce store. We don't feel…
Kelvin
  • 173
  • 1
  • 1
  • 6
0
votes
2 answers

Heeeelp! False positives from ZoneAlarm Force Field on my website will scare users away

I recently helped create a website for a conference that I am helping to host. We mailed out about 30,000 brochures and are expecting the big wave of traffic to start in a day or two. However, we keep on getting reports from people visiting the…
None
0
votes
1 answer

Cisco Umbrella Identifies DNS Request as Malicious and Looks Like it's From our Domain Controller

Our Cisco Umbrella service is identifying DNS requests to rev1.globalrootservers.net and rev2.globalrootservers.net as malicious. I am trying to figure out whether this is really a problem or if it is a false positive. Below is all the…
user611054
  • 29
  • 3
0
votes
0 answers

IS this error an Ancient “su – hostile” vulnerability in Debian 8 & 9 ? $ bash: cannot set terminal process group (-1): Inappropriate ioctl for device

Just received this error >> bash: cannot set terminal process group (-1): Inappropriate ioctl for device then the disk partition went into READ-Only mode ; also noticed gnome-software was communicating both upload and download over the…
0
votes
1 answer

How does the Miner kinsing infects my system

I have - like few dozen others - the Miner kinsing in my deployment. Unlike the others I have an minimal server with no redis installed and also no cron. The only things I've installed is symfony, php-fpm and apache in a docker evironment. However -…
logg sar
  • 1
  • 3
0
votes
1 answer

How to stop my server from bruteforcing another

There are so many resources on how to stop bruteforce attacks on your server, but I can't find any good on bruteforce attacks FROM a shared hosting server. I am getting a lot of reports from many different providers that my servers is attacking…
0
votes
0 answers

license.php file is automatically getting created on shared hosting server

On my shared host, license.php file is automatically getting created at root folder/directory of every domain. I have find and deleted this file multiple times from everywhere. Here is the code of the file on GitHub Gist:…
0
votes
0 answers

Is there a command to list all active maldet scans?

I relatively often run 2 or more scans on a server simultaneously (unfortunately some servers contain many users that manage to get their files infected simultaneously) and on many of those occasions a command that would list how many scans are…