Questions tagged [rootkit]
Rootkits are programs designed to hide malicious activity on a compromised computer by hiding files, processes or registry entries.
76
questions
0
votes
0
answers
90
views
Possibly Malicious code execution on startup
Checked my event viewer to see if my system was starting any funny commands. This is due to the fact i noticed a sudden slowdown on my pc after startup.
Im wondering if an event like this is normal; ...
- 11
0
votes
0
answers
190
views
BIOS has a password which I never set (Rootkit?)
Background info: our network was infected years ago by a hacker (loser stalker). I suspect he was using Remote Desktop, as the icon appeared when I unhid Windows items, like it had been used. I re-...
0
votes
2
answers
80
views
I am getting a weird error, should I be worried ? The error has weird characters and says "fatal javascript error occured"
Here is the error below. I accidentally deleted some files so I am just curious if this is a virus.
- 1
1
vote
0
answers
159
views
rkhunter Apache2 Warning caused by phpmyadmin-Docker-Container
recently we get the following reports from rkhunter:
Warning: The following processes are using suspicious files:
Command: apache2
UID: 33 PID: 11286
Pathname:
Possible ...
- 11
2
votes
1
answer
236
views
Will installing new Windows build remove any rootkits and trojans?
I have currently installed 2004 version of Windows 10, if i update it to 20H2 version, will i get rid of any trojans or rootkits on my computer? Where are those typically get installed? I don't want ...
user1276860
0
votes
2
answers
245
views
Will disabled secure boot put at risk my pc?
I'm having Win10 and Linux on dual boot on my PC. I'm using Linux all the time but now I want to play something that runs only on Win10. The secure boot on my PC is disabled. On Windows I've got only ...
- 19
0
votes
1
answer
433
views
High CPU usage unless task manager opened, but no rootkit detected
I am using Windows 10 (v1903). Whenever I open Task Manager, I see that CPU usage is at 100% -- but then it plummets to ordinary numbers (typically below 20%). This change happens so quickly that I ...
- 131
0
votes
0
answers
27
views
How to force run antivirus at boot time if a persistent virus present? [duplicate]
Recently i get a virus, undetectable with virus scanners in offline OS state. The virus doesn't let to run antiviruses, debuggers, cmd, msconfig.
Unfortunately, by backup is broken.
My idea is to ...
- 129
0
votes
1
answer
341
views
Scanners cannot find a virus - are there alternative scanning technologies? [duplicate]
Leading antiviruses / scanners (Kaspersky, Bitdefender, AVG, Avira, SuperAntiSpyware, MalwareBytes, ... etc. from 2k10 USB drive), AVZ cannot detect a virus in Windows 7 x64 installation that ...
- 129
2
votes
1
answer
215
views
Why I can see lot more free disk space as root than as a user?
When I am logged in as a user, I can see free disk space: 1.2 Gb, with Midnight Commander. Surprisingly when I run "sudo mc" then Midnight Commander shows a lot more free disk space: 1.9 Gb. How is it ...
- 653
0
votes
1
answer
282
views
Is this some type of malware?
I ran chkrootkit on my Linux Mint system, and it complained about several processes like this one:
scott 31745 0.0 0.3 1206060 120352 ? Sl Oct03 0:15
/usr/share/atom/atom --type=...
- 141
0
votes
0
answers
99
views
Isolate (secure) multiple boot images from harming my PC
Is it possible to protect my bare-metal from compromise, so that I can be fairly confident that (for example) restoring a VHDX system image every month keeps me clean? If so, how?
I'm building a ...
- 101
0
votes
0
answers
528
views
Chkrootkit False Positive?
After setting up a fresh Kali system in VB I decided to do a chkrootkit to check the filesystem. Chkrootkit identified a lot of suspicious files. Is this a false positive or something to be concerned ...
- 11
-2
votes
1
answer
199
views
Format and encrypt compromised USB stick with TrueCrypt to make it clean again?
Let's say I bought an used USB stick from a very professional hacker who has compromised the stick with really professional methods, the NSA or FBI would use to compromise it: Would it be safe to ...
- 123
0
votes
1
answer
2k
views
Windows 10 Reset PC with malwares,viruses and rootkits
I have been recently wondering whether the option we have in windows 10 to reset the PC, which includes the reset function that does a deep scan and delete all files in all partitions and drives, get ...
- 13
1
vote
1
answer
168
views
are there any rootkit/virus/malware/etc.. that a windows 7 factory install could leave behind?
can any sort of malware/ rootkit still be on my computer after a factory install? my dell inspiron running windows 7 had(maybe still does) some sort of malware (a rootkit maybe) at its worst point it ...
- 11
0
votes
1
answer
154
views
Computer possibly hacked. Now what
I think someone somehow managed to gain remote access to my computer and was able to log into my ebay account and purchase some stuff. I was noticed the suspicious activity, and yanked the power cord, ...
- 317
0
votes
0
answers
42
views
Prevent www.win32.cn/g9 being run automatically [duplicate]
I have recently bought an a4 tech wireless mouse + keyboard. Everything was working fine, but when i started cmd as admin, i started getting the run command automatically and it executes www.win32.cn/...
- 109
2
votes
1
answer
115
views
Sony CDs and "Rootkit scandal"
I recently bought a secondhand copy of a CD that was part of the Sony "Rootkit Scandal" in 2005. I assume it to be infected until proven otherwise. Am I safe to try to rip this on my PC with modern AV ...
- 172
1
vote
1
answer
540
views
Can rootkits and malwares affect a live ubuntu usb with no peristence?
Can rootkits and malwares affect a live ubuntu usb with no peristence ? Can any malware possibly persist and affect all the sessions ? Also, can it affect current session if it cannot persist ? I am ...
- 51
1
vote
0
answers
162
views
Is this malware?
I have a machine running Linux Mint (qiana). I noticed it was often slow and when I looked at top I found
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND ...
0
votes
2
answers
392
views
My friend fell for a tech support scam. I formatted her computer. What should I do now?
My friend received a call from a person claiming to be a Microsoft tech support representative. This person claimed her laptop was infected with malware and compromised by hackers. He proceeded to ...
- 15
6
votes
2
answers
1k
views
Why is elasticsearch user running SSHD?
My home network is frequently down and I've narrowed down the problem to my ubuntu box.
$ ps -ef | grep elastic
elastic+ 11183 1 0 8월10 ? 00:07:49 [.ECC6DFE919A382]
eugenek+ 14482 14453 0 ...
- 317
0
votes
0
answers
18k
views
What is ".HFS+ Private Directory Data" and why is it SO BIG?
I’m recovering this old disk I accidentally formatted, and stumbled across a hidden and HUGE folder of questionable origin.
I can plainly see the folder’s contents thru a data rescue program. By ...
- 1,665
-5
votes
1
answer
191
views
What is a rootkit?
I use Avast as my antivirus. Yesterday while using my system, an Avast popup came up saying 'a suspicious rootkit has been found'. Avast suggested to delete it and I did so. Normally when Avast finds ...
- 733
2
votes
2
answers
1k
views
Process With No Name: A Possible Linux Rootkit?
Situation
When I was looking at gnome-system-monitor one time, I saw a process without a name. Didn't bother me at first. Later, my laptop seemed to be heating up, and would see spikes in CPU ...
- 856
2
votes
2
answers
584
views
Cannot delete folder or files inside
I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged ...
- 51
2
votes
1
answer
379
views
VirtualBox VM Rootkit Infection
What is the risk of having a host machine infected if a VirtualBox VM running on the host gets infected? Let's assume both run Windows 7.
- 21
0
votes
1
answer
676
views
OS X Rootkit Hunter 0.2 - Results - Help interpreting
maybe someone can help me makes sense if these scan results are something to be worried about and if so, how to fix them. I seems that I do not have any viruses (check with Sophos AV) or rootkits, but ...
- 81
0
votes
0
answers
106
views
Rootkit I can not find.
I am running windows 7 ultimate. Chrome Browser. and advance system care. I have run every malware scanner I can find and all the rootkit scanners as well. Nothing seems to be able to find this thing. ...
- 109
3
votes
4
answers
139
views
How does badBIOS jumps airgaps? [closed]
I was reading this article from Ars on badBIOS and came across this line which states
the malware, has the ability to use high-frequency transmissions passed between computer speakers and ...
- 2,700
11
votes
4
answers
2k
views
Am I attacked or just stupid?
I run a server using Debian Squeeze with several OpenVZ containers. The containers run mostly Squeeze, some Lenny, and some already updated to Wheezy. The host doesn't do that much beyond iptables and ...
- 211
1
vote
1
answer
5k
views
How to find out if my MBR is infected?
I imagine that bootkits and other malware can install themselves in the MBR and be invisible to antivirus software running after the MBR was executed.
Is there any way to execute an antivirus scan on ...
- 143
1
vote
3
answers
4k
views
"autorun.inf" autogenerated in each drive generates EXE and PIF files in Windows CP [duplicate]
I have Windows XP SP2 installed on my laptop, its been infected by a virus, which creates autorun.inf in each of my drives as read-only, hidden and system file attribute being set, and which generates ...
- 171
0
votes
1
answer
301
views
Need guidance in understanding rkhunter results
Today, I performed a system wide scan for rootkits using the rkhunter --check command. All results were ok, with the exception of a warning:
[10:14:30] Warning: The command '/usr/bin/unhide.rb' has ...
- 985
1
vote
0
answers
2k
views
EFI partition malware?
I have a 2011 Macbook Pro, running 10.8.2 and was worried that the laptop may have been tampered with while left unattended for a few days while abroad in Asia.
I have mounted my EFI partition using:
...
2
votes
1
answer
4k
views
If I connect a USB drive to a PC with a rootkit, will the USB drive be infected as well? [closed]
I'd like to know if I run the risk of infecting a pendrive if I connect it to a PC with a rootkitted hard disk.
Let's say I have a PC infected with the TDSS rootkit, and I run tdsskiller from a USB ...
- 187
1
vote
2
answers
592
views
How do I remove a root kit from Windows XP? [duplicate]
Possible Duplicate:
How do I get rid of malicious spyware, malware, viruses or rootkits from my PC?
I was looking for root kits following these instructions
http://computersight.com/software/how-...
- 5,796
0
votes
1
answer
3k
views
Remove or Disable MBR from old C:\ Drive
Using a USB to Sata connection from an old XP box, is it possible to remove/disable the MBR\boot sector on a drive pulled from a Win7 box?
C: - I can see the drive and folders and such on my XP box, ...
- 191
2
votes
1
answer
3k
views
No internet connection on laptop
I'm trying to recover from a rootkit infection, where I am unable to connect to the internet.
When I try to ping the router this is the output:
Pinging 192.168.1.254 with 32 bytes of data:
Reply ...
- 728
2
votes
1
answer
1k
views
My computer gives a known virus warning and reboots
"Windows must now restart because the Plug and Play service terminated
unexpectedly."
"Windows must now restart becasue the DCOM Server Process launcher
service terminated unexpectedly."
...
- 21
0
votes
1
answer
1k
views
Unknown undeleteable, unformattable partition
I had two partitions on my hard drive labeled as unknown in gParted that showed up out of nowhere. I use 3 OS's on my computer, Windows which I just recently deleted, Backtrack5, and Ubuntu 12.04 ...
- 103
1
vote
0
answers
2k
views
is it possible to monitor dll injection events on Windows, such as to detect user mode rootkits?
wikipedia article's section on user mode rootkits is not quite clear about the mechanism of injecting code into running processes. Does this take advantage of normal OS functionality and so could be (...
3
votes
2
answers
41k
views
what does it mean for MalwareBytes to find malicious registry keys but nothing else?
I have a machine that is obviously infected, and when I ran MalwareBytes it told me that it found some "malicious" registry keys (surprisingly enough these contained file path to currently non-...
0
votes
2
answers
612
views
rogue process consumes too much memory in linux
I was going through the output of top when i saw a process listed as
pine -i
I don't have pine in my system !
Then i got into proc and did a
`ls -l /proc/9827/exe`
9827 is the process id. It ...
F F
3
votes
1
answer
205
views
Can signature verification expose a rootkit?
I know that rootkits operate as part of the kernel, driver or service running on the system, injecting themself into DLLs or installing as a legitimate applications.
If I were to scan the system with ...
- 359
-1
votes
1
answer
948
views
Deleting content in swap space and emptying cache using terminal in linux
Wish a script which would delete cache content and remove additional files which have been downloaded via the internet and saved voluntarily by the user and files any thing other than those used by ...
60
votes
7
answers
25k
views
My webcam just came on "out of the blue"
I have a Microsoft LifeCam HD sitting atop my monitor. Today, completely out of the blue, its light came on -- I was simply browsing the web (in Chrome) when it happened. After about 5 minutes the ...
- 18.3k
2
votes
3
answers
4k
views
rootkit: Avast says it deletes it, but it detects it every time I boot up. How do I get rid of this?
After cleaning up the majority of my malware infestation with Process Explorer and Autoruns I am relying on Avast antivirus to clean up the rest. It continues to find a rootkit described as follows:
...
- 135
1
vote
2
answers
615
views
Examples of usable rootkits
I'm trying to learn more about rootkits and was hoping to take one and let it loose in a virtual environment.
Does anyone know of a rootkit currently available that I can safely use to do this, and ...
- 111