The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
50 views

Host says server is affected by malware, anyone knows this one ? What to do? [duplicate]

My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS. Anyone ...
-2
votes
1answer
293 views

Malware removal from the code [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY My web application has been hacked and trying to remove the malware/code injection. Scanning it through http://sitecheck.sucuri.net ...
1
vote
1answer
199 views

Apache error_log showing which command output

Apache's error_log shows lines like the following: --- snip --- which: no ruby in (/sbin:/usr/sbin:/bin:/usr/bin) which: no locate in (/sbin:/usr/sbin:/bin:/usr/bin) which: no suidperl in ...
11
votes
3answers
871 views

Finding how a hacked server was hacked

I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do? The best answer is ...
312
votes
12answers
55k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
0
votes
7answers
345 views

Can databases alone host a hack?

I was hacked recently. The hack seems to redirect any site on my server to a fake virus site. So I deleted all my website files and the hack seemed to go away. About a week later, it's back -- the ...
0
votes
2answers
1k views

Server hacked for SPAM, The BAT in X-Mailer

Our server has been hacked and I am trying to track down the cause. The server is being for SPAM purposes and it looks like IIS is being using to send the emails as the badmail and queue folder are ...
0
votes
3answers
446 views

Recover from server phishing hijack

My server was compromised last year and a phishing site was uploaded. It was detected and removed within a few days. A year later I'm still getting huge volumes of traffic to the dodgy url on my ...
3
votes
4answers
770 views

How to clean up hacked user account (not root)?

So I setup a linux server and forgot to disable clear text ssh password or install denyhosts or enable any kind of password policy. Usually I have deny hosts and it works well. As a result of missing ...
44
votes
6answers
3k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
0
votes
0answers
3k views

Aftermath of Hack

We recently faced a full scale attack on one of our servers running Open SUSE 11.0; the intruder deleted a lot of files necessary for day to day operation. Although the backups came in handy but for a ...