Linked Questions

22
votes
8answers
15k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
7
votes
2answers
5k views

Hacked Ubuntu server, probably hacked commands (netstat, ps, …), how to replace them? [duplicate]

An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that ...
7
votes
4answers
5k views

What is nuke it from orbit? [duplicate]

I was reading this Windows 2003 Enterprise infected by Conficker; post-infection problems continue And they talk about nuking it from orbit (which apparently means wiping out the system and starting ...
1
vote
0answers
63 views

Bought a used surface book online, any security precautions to take? [duplicate]

I have purchased a used surface book from Ebay, unpackaged and ran the device. The low price of the device lured me in despite my adverse attitude to used devices. Is there anything I need to perform ...
188
votes
11answers
33k views

Search for military installed backdoors on laptop

My laptop was confiscated by the military institute of my country and they made me to give them all my passwords (I cannot tell you the name of my country). They did not give it back to me for one ...
169
votes
10answers
41k views

Should I be concerned if the “FBI” has logged onto my Ubuntu VPS?

Yesterday, I was performing a bit of general maintenance on a VPS of mine, using the IPMI console my host provided. Upon setting up SSH keys again via the IPMI console, I logged in via SSH and was ...
42
votes
9answers
12k views

What to do when I found a spyware that my spouse has installed?

Today I was trying to uninstall some application and I was very surprised to see this entry in my applications list Then I try to find what is this and I finally found it in "Program Files". After I ...
23
votes
4answers
11k views

Should I change all my passwords due to heartbleed [duplicate]

Should I change all of my online passwords due to the heartbleed bug? Edit: I found a list of vulnerable sites on GitHub and checked all my critical sites. Everything I was really concerned with ...
16
votes
6answers
20k views

How can I safely back-up files from an infected computer?

Imagine a laptop that's been infected by malware, and that the owner hasn't backed-up their files.* They have pictures, videos, and documents they'd like to preserve, so they're hesitant to ...
15
votes
5answers
5k views

Can a Trojan horse hide its activity from TCPView?

Can a Trojan horse hide its activity from TCPView? I've done a little research before asking, but I still can't find the answer for this. I know that a Trojan horse can hide from the Windows Task ...
19
votes
4answers
3k views

ESET warns: Skype attempting to communicate with unknown remote computer

I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate: The remote ...
9
votes
4answers
2k views

Can we trust the information displayed by the linux utility commands for a vulnerable machine?

After checking a vulnerable linux machine for rootkit and deleting them, we need to get some informations about the process , port ,incoming or outgoing connections... , using some useful commands as ...
5
votes
5answers
2k views

Windows 2003 Enterprise infected by Conficker; post-infection problems continue

I used various tools to remove Conficker, and I pretty much succeeded, but I've had recurring problems afterward. It won't update anymore (with the following error message: 0x800706B5) I tried ...
1
vote
3answers
34k views

My computer was being remotely controlled by someone. Can find no viruses

Walking back to my computer (Windows 10), I noticed that my browser's history tab had just opened without me touching it and I thought I saw my cursor moving around. I had no control over my mouse ...
3
votes
1answer
3k views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
3
votes
4answers
953 views

Can I safely trust my Anti-virus protection?

Recently when I was trying to install a software which didn't happen to be from reputed sources, my anti-virus popped up a warning saying: XYZ-antivirus blocked you from visiting an infected webpage ...
5
votes
1answer
3k views

Unable to get rid of Sality on my Dropbox

The story... As a group of rookie security researchers who deal with malwares, viruses etc., me and my team-mates sometimes do commit mistakes in handling the binaries. And so, I ended up infecting ...
0
votes
4answers
3k views

how we know whether our computers are part of a botnet? [closed]

When we visit websites, unknowingly our computers can be a victims of a botnet. There should be a way to identify whether we are victims or not. What is the way to identify it and how to recover from ...
3
votes
1answer
1k views

Someone is injecting malware into my website

My website was hacked last year and someone had uploaded a script which was hogging up all CPU and load avg went up to 30+ till our hosting provider temporally suspended the account, that was a few ...
1
vote
2answers
2k views

Is this Android malware?

I am randomly getting redirected to a page that looks very suspicious, especially the URL that sends the base64 encoded payload. It usually happens when I click a news link, usually a local news site. ...
4
votes
3answers
735 views

Best way to check if your browser is secure

There is a lot of Malware checking software which seems is just a virus. How can you check for sure that your Windows 8 computer is uninfected with virus and malware? Is malwarebytes enough, or ...
1
vote
1answer
269 views

Server infected with some kind of miner - can I steal the results?

A Windows server of ours got infected with some kind of mining tool. As luck (?) would have it, the tool left plenty of logs. The logs suggest it's a Claymore CryptoNote CPU Miner v3.5 Beta. Outside ...
3
votes
4answers
535 views

How to know if virus alert is false positive?

I received alerts (email & browser injection) from my ISP about a Zbot infection behind my modem. I ran Microsoft's malicious software removal tool, as well as AVG's Zbot remover on both my ...
0
votes
3answers
326 views

Next steps to get rid of malware? [duplicate]

My father in law just had a problem,He clicked on a link in an email (he was using gmail on the version 35.0.1916.114m of Chrome), and suddenly the computer sort of went black, and possibly something ...
0
votes
2answers
612 views

How dangerous are worm:win32/Goldrv!rfn and worm:win32/vbjk?

Windows defender has detected the following worms on my system and I was wondering how dangerous are they and what is it that they do?
-1
votes
1answer
205 views

Windows “Send to compressed file” creates an image? [closed]

One of my friends windows laptops (which I don't have access to right now) has in the recent past had a virus (where .doc files were converted to .exe files) which we dealt with. Now when she right-...
1
vote
2answers
229 views

Strange name on “shared”, was I hacked?

I use a Macbook Air 2013 and I recently noticed a very strange and long line of digits and letters under my "shared" category in finder. When I click on the name, it just says "failed to connect." It ...
1
vote
1answer
176 views

Is the SSH last login message reliable or rather something easy to get tampered with?

My client's Linux server recently got compromised by unknown means (highly likely because of a weak password). When I first logged into the compromised server I discovered the following: The Log ...
4
votes
1answer
115 views

Thorough computer scan

I'd like to give my computer an overall deep scan against all kinds of malware. I was infected about a year ago and I feel like there may still be some hidden rootkit on my HDD or something like that....
0
votes
3answers
112 views

phishing from chrome

This just showed up in Chrome. It's obviously phishing - the mangled English and weird url give it away. How would it work? Asking me for info I shouldn't give them? My system then slowed down. ...