Linked Questions

22 votes
8 answers
15k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
An Phan's user avatar
  • 321
7 votes
2 answers
5k views

Hacked Ubuntu server, probably hacked commands (netstat, ps, ...), how to replace them? [duplicate]

An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that ...
roghan's user avatar
  • 97
7 votes
4 answers
6k views

What is nuke it from orbit? [duplicate]

I was reading this Windows 2003 Enterprise infected by Conficker; post-infection problems continue And they talk about nuking it from orbit (which apparently means wiping out the system and starting ...
user13267's user avatar
  • 359
1 vote
0 answers
68 views

Bought a used surface book online, any security precautions to take? [duplicate]

I have purchased a used surface book from Ebay, unpackaged and ran the device. The low price of the device lured me in despite my adverse attitude to used devices. Is there anything I need to perform ...
Gleb Pilipenko's user avatar
170 votes
10 answers
42k views

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

Yesterday, I was performing a bit of general maintenance on a VPS of mine, using the IPMI console my host provided. Upon setting up SSH keys again via the IPMI console, I logged in via SSH and was ...
lol what is this's user avatar
43 votes
9 answers
13k views

What to do when I found a spyware that my spouse has installed?

Today I was trying to uninstall some application and I was very surprised to see this entry in my applications list Then I try to find what is this and I finally found it in "Program Files"....
Green Fly's user avatar
  • 1,957
23 votes
4 answers
11k views

Should I change all my passwords due to heartbleed [duplicate]

Should I change all of my online passwords due to the heartbleed bug? Edit: I found a list of vulnerable sites on GitHub and checked all my critical sites. Everything I was really concerned with ...
derelict's user avatar
  • 348
19 votes
6 answers
30k views

How can I safely back-up files from an infected computer?

Imagine a laptop that's been infected by malware, and that the owner hasn't backed-up their files.* They have pictures, videos, and documents they'd like to preserve, so they're hesitant to ...
user avatar
14 votes
5 answers
7k views

Can a Trojan horse hide its activity from TCPView?

Can a Trojan horse hide its activity from TCPView? I've done a little research before asking, but I still can't find the answer for this. I know that a Trojan horse can hide from the Windows Task ...
JohnSt's user avatar
  • 175
19 votes
4 answers
3k views

ESET warns: Skype attempting to communicate with unknown remote computer

I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate: The remote ...
Shaul Behr's user avatar
  • 1,027
9 votes
4 answers
2k views

Can we trust the information displayed by the linux utility commands for a vulnerable machine?

After checking a vulnerable linux machine for rootkit and deleting them, we need to get some informations about the process , port ,incoming or outgoing connections... , using some useful commands as ...
GAD3R's user avatar
  • 2,231
2 votes
1 answer
1k views

How to replace certain backup files on a website every 30 minutes? [closed]

I have a website built with WordPress, unfortunately somebody hacked it several times, deleted my adsense code and put his own adsense. I tried many security techniques, changed database name, did ...
Arnold Rothstein's user avatar
5 votes
5 answers
2k views

Windows 2003 Enterprise infected by Conficker; post-infection problems continue

I used various tools to remove Conficker, and I pretty much succeeded, but I've had recurring problems afterward. It won't update anymore (with the following error message: 0x800706B5) I tried ...
user164144's user avatar
1 vote
3 answers
49k views

My computer was being remotely controlled by someone. Can find no viruses

Walking back to my computer (Windows 10), I noticed that my browser's history tab had just opened without me touching it and I thought I saw my cursor moving around. I had no control over my mouse ...
Vaidd's user avatar
  • 31
3 votes
1 answer
3k views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
Kumar's user avatar
  • 161
3 votes
4 answers
1k views

Can I safely trust my Anti-virus protection?

Recently when I was trying to install a software which didn't happen to be from reputed sources, my anti-virus popped up a warning saying: XYZ-antivirus blocked you from visiting an infected webpage ...
pnp's user avatar
  • 1,808
5 votes
1 answer
3k views

Unable to get rid of Sality on my Dropbox

The story... As a group of rookie security researchers who deal with malwares, viruses etc., me and my team-mates sometimes do commit mistakes in handling the binaries. And so, I ended up infecting ...
pnp's user avatar
  • 1,808
0 votes
4 answers
3k views

how we know whether our computers are part of a botnet? [closed]

When we visit websites, unknowingly our computers can be a victims of a botnet. There should be a way to identify whether we are victims or not. What is the way to identify it and how to recover from ...
Vijini's user avatar
  • 339
1 vote
2 answers
3k views

Is this Android malware?

I am randomly getting redirected to a page that looks very suspicious, especially the URL that sends the base64 encoded payload. It usually happens when I click a news link, usually a local news site. ...
rys's user avatar
  • 123
3 votes
1 answer
1k views

Someone is injecting malware into my website

My website was hacked last year and someone had uploaded a script which was hogging up all CPU and load avg went up to 30+ till our hosting provider temporally suspended the account, that was a few ...
Srihari Karanth's user avatar
4 votes
3 answers
1k views

Best way to check if your browser is secure

There is a lot of Malware checking software which seems is just a virus. How can you check for sure that your Windows 8 computer is uninfected with virus and malware? Is malwarebytes enough, or ...
magister's user avatar
  • 141
1 vote
1 answer
330 views

Server infected with some kind of miner - can I steal the results?

A Windows server of ours got infected with some kind of mining tool. As luck (?) would have it, the tool left plenty of logs. The logs suggest it's a Claymore CryptoNote CPU Miner v3.5 Beta. Outside ...
MBender's user avatar
  • 380
3 votes
4 answers
630 views

How to know if virus alert is false positive?

I received alerts (email & browser injection) from my ISP about a Zbot infection behind my modem. I ran Microsoft's malicious software removal tool, as well as AVG's Zbot remover on both my ...
Brack's user avatar
  • 455
1 vote
2 answers
937 views

Abusing Shell Feature for Privilege Escalation

This was covered in Linux PrivEsc, task 15, in this TryHackMe room. I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
questioner's user avatar
0 votes
3 answers
383 views

Next steps to get rid of malware? [duplicate]

My father in law just had a problem,He clicked on a link in an email (he was using gmail on the version 35.0.1916.114m of Chrome), and suddenly the computer sort of went black, and possibly something ...
Rahul's user avatar
  • 1
0 votes
2 answers
996 views

How dangerous are worm:win32/Goldrv!rfn and worm:win32/vbjk?

Windows defender has detected the following worms on my system and I was wondering how dangerous are they and what is it that they do?
Django's user avatar
  • 35
-1 votes
1 answer
262 views

Windows "Send to compressed file" creates an image? [closed]

One of my friends windows laptops (which I don't have access to right now) has in the recent past had a virus (where .doc files were converted to .exe files) which we dealt with. Now when she right-...
Matt Parkins's user avatar
1 vote
2 answers
285 views

Strange name on "shared", was I hacked?

I use a Macbook Air 2013 and I recently noticed a very strange and long line of digits and letters under my "shared" category in finder. When I click on the name, it just says "failed to connect." It ...
user56829's user avatar
1 vote
1 answer
326 views

Is the SSH last login message reliable or rather something easy to get tampered with?

My client's Linux server recently got compromised by unknown means (highly likely because of a weak password). When I first logged into the compromised server I discovered the following: The Log ...
Sir Muffington's user avatar
4 votes
1 answer
207 views

Thorough computer scan

I'd like to give my computer an overall deep scan against all kinds of malware. I was infected about a year ago and I feel like there may still be some hidden rootkit on my HDD or something like that....
user104674's user avatar
0 votes
3 answers
193 views

phishing from chrome

This just showed up in Chrome. It's obviously phishing - the mangled English and weird url give it away. How would it work? Asking me for info I shouldn't give them? My system then slowed down. ...
Ethan Bolker's user avatar