Hello,
Here is my problem:
- I’ve a raspberry where I have installed Cozy with the special image cozy-raspberrypi
- I’ve also installed NextCloud, fail2ban, Piwigo
- I’ve disable Cozy
Today when I wanted to modify nginx cozy.conf it appear to be a binary file. I recover it from a backup but nginx refuse to restart.
Looking at nginx.conf it as the following content:
23:Win.Malware.Locky-16999
a4638227c562240d95bbf40cb15173fc:2867:Win.Malware.Locky-17001
f7c7e6a011047af5554c726296a1cade:1363:Win.Malware.Locky-17077
97cdbbfb2c22627868feff2b3556e1e2:7974:Win.Malware.Locky-17079
01ba67c25a131485db93c0aea2c53fd2:2818:Win.Malware.Locky-17080
baa4af2fb362fbd108b10d2dcd68a5bd:2838:Win.Malware.Locky-17081
474d20e8f33d39dfc7520b78fad3d81a:1375:Win.Malware.Locky-17082
703d65601a10f6e396cc04cf237138d4:7942:Win.Malware.Locky-17083
7d2f60ad897335b559e2aa3b5a2bfdd9:8022:Win.Malware.Locky-17084
1c1b21e51ecf1abc9f4ac0b5a275ce7a:3884:Win.Malware.Locky-17118
7aca0ebc6140e090a19739b519bb2810:1374:Win.Malware.Locky-17123
ecdd9b429abe4fa3099850c42ae49dde:1370:Win.Malware.Locky-17124
24eb6624348178e5654694c02d2878d8:3922:Win.Malware.Locky-17160
0a85c69401ec8ba5bb09d15327c92968:1366:Win.Malware.Locky-17197
2dd8eba484c28dcba5e7ee6a8b1dba20:3930:Win.Malware.Locky-17201
d8f12663a2b98f0e86c6fedb58b3fef3:2831:Win.Malware.Locky-17236
1db2655329ac4e7d02e4720036671bff:9210:Win.Malware.Locky-17237
e2a565c2de661679a63c59fc756409d5:1363:Win.Malware.Locky-17238
9140f60d0e396759f994614d2e7119c8:1378:Win.Malware.Locky-17240
8e391fb9fe58c18bb440cd803f6f149e:2806:Win.Malware.Locky-17243
36d397908c7deee17e2386ca57adf94f:3909:Win.Malware.Locky-17244
a491855f479a2a5a6ccc977cc7b19482:1360:Win.Malware.Locky-17278
7554b0c5bbb6f5c4a95abb9d007c8637:6842:Win.Malware.Locky-17279
1ec726ef8c8d2a28e2151bc041d277f0:2769:Win.Malware.Locky-17280
e9abde54ed6df6f7c21e26aa37fc8b63:422842:Win
How this could happen ?
Probably nothing to do with Locky as it is a windows malware but really strange !
There is also corrupted log files, for example /var/log/nginx/access.log.1 :
32388:9fc3cef3ffb34071682db0284f6f3638:Win.Trojan.Agent-1385755
127488:559008d3fbca6e43b199ca2e47f05120:Win.Trojan.Agent-1385756
43008:aa17e0fc8179165e54bb4ec391a9b850:Win.Worm.Allaple-218054
The nginx log of my real nginx server has a different name but is also partly corrupted like this.
What can I check to understand what’s wrong ?
Port open on my router : 80(http),443 (https), 22 (ssh)
Thanks for any help.