Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
3
votes
2answers
125 views
Rootkit Revealer is failing to run, why? [duplicate]
On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
0
votes
3answers
59 views
watch file to see whos accessing/writing it and log it
I am facing some malware problems on my webserver.
I updated third party software such as Wordpress to the latest version, disabled root logins and my users password complex enough but still someone ...
-3
votes
1answer
72 views
How to prevent non-power-users with admin rights from accidentally installing adware on community pc [closed]
I am going to describe my problem and solution to prevent non-power-users installing unwanted software along with other software (adware installed through pre-set checkboxes in a "desired software ...
0
votes
1answer
75 views
Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role
Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this:
The message repeats every second and the port number is increased by one the range ...
0
votes
1answer
51 views
Malicious HTTP Post reuqest decoding
I have this request in my traffic, which is posting data to a malicious php file.
T 212.193.229.17:60601 -> 9.9.9.9:80 [A]
POST /images//sh.php HTTP/1.0.
Host: dpfremovalwarrington.co.uk.
...
1
vote
2answers
135 views
Malware : Identifying & Cleaning Malware on a LAMP site
EDIT : Further information / investigation information contained in the comments to this post
Apologies for the vague title - had trouble summarising this one.
I have recently discovered that one of ...
0
votes
1answer
93 views
Trying to hunt down malware on my server [duplicate]
Possible Duplicate:
My server’s been hacked EMERGENCY
A server of mine recently suffered a malware attack. I've since cleaned the server up a bit, upgraded a variety of wordpress installs ...
1
vote
0answers
69 views
Mass targeted malware installed - g00glestatic.com [duplicate]
Possible Duplicate:
My server’s been hacked EMERGENCY
I run a webserver which over the last few days seems to have become infected with malware that tries to include content from ...
0
votes
1answer
64 views
Compromised web server/multiple domains [duplicate]
Possible Duplicate:
My server’s been hacked EMERGENCY
Earlier today I found a lot of weird files on one of my servers (running Ubuntu Server 10.04), which I can't understand how they got ...
-2
votes
1answer
223 views
Malware removal from the code [duplicate]
Possible Duplicate:
My server’s been hacked EMERGENCY
My web application has been hacked and trying to remove the malware/code injection.
Scanning it through http://sitecheck.sucuri.net ...
1
vote
1answer
113 views
String search and replace across an entire database
After an exploit on an ASP.NET site, the client was left with a specific string of malware code sprayed across the entire database, multiple columns of multiple tables. The prepended string is ...
0
votes
0answers
16 views
Wordpress hacked. Disabled hacked site but bad traffic continues [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
My Ubuntu 10.04 LTS VPS has been hacked, probably via a WordPress site.
I was alerted to it when I noticed the incoming traffic ...
1
vote
0answers
1k views
Folders on our server2003-share are being “hidden”, replaced by .exe files
We have had following problem on our Windows2003 server for weeks now, every day the folder on our share are being made hidden and replaced by .exe files with the same names as the original folders. I ...
-1
votes
1answer
667 views
Anti-Malware Antivirus for Linux Web Server? [closed]
Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
1
vote
1answer
85 views
Hyper-V or VMware - Find all modifications/changes made between 2 Snapshots
I would like to use either Hyper-V or Vmware in order to find out after taking a Clean Base snapshot and a modified snapshot and what the modifications/differences and what was changed between the two ...
2
votes
2answers
208 views
Why computer scanning network?
I have found out through Wireshark that a computer in my subnet scanning network ( sending ARPs for every IP-address in my subnet. Even if there no computers with such address).
It repeats ...
1
vote
2answers
2k views
Got a malware on my hosting provider which infect JavaScript files .. how do I find the entry point?
This morning some sites which are hosted on the server as me started triggering malware alerts and started to redirect traffic to external sites.
I've found out that a line of packed javascript was ...
2
votes
1answer
337 views
Does windows 7 remember shared folder passwords to entire server instead of by share?
So I have a copy of Windows 7 Enterprise edition on my home computer. I've connected from the home computer to a network share on my windows 2003 server at work before. I assume that I told it to ...
-3
votes
2answers
434 views
Rootkit scanning
Are there any good services or ways to scan for rootkits and backdoors?
I know there are rkhunter and chkrootkit but are they even ideal anymore? They never seem updated and look more like they were ...
1
vote
1answer
191 views
Identifiying weird chinese registry entries in CurrentControlSet\Services
I noticed chinese characters inside my register under HKLM\System\CurrentControlSet\Services. Inside these there was nothing. I googled the strings and found nothing. Anyway for me to identify these? ...
0
votes
1answer
231 views
identity and rectify port scanning activities on CentOS [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
My Linux (CentOS 5.x) machine seem to have been attacked. Port scanning activities were traced to it. However, the ports (to be) ...
1
vote
3answers
465 views
Scan whole system or just user dirs with clamav
I'm in doubt about how to scan my Linux system with Clamav: do I just scan the places where users can upload files (homedirs, their webroots) or do I scan the whole system?
The various sites I've ...
1
vote
2answers
158 views
One machine blocked from a single server, and only when it's at this physical location?
I host an e-commerce website for a client who suddenly is unable to access it from his computer. He can ping the server, he can SSH in, but cannot load the website in any browser we've tried: IE, ...
0
votes
2answers
71 views
strange tcp network connections 149.9.1.16:ircd [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
I am seeing strange tcp connection 149.9.1.16:ircd ans it is running perl service
and that process is creating huge load on server
...
0
votes
1answer
63 views
Good resource for evaluting AV and anti Malware software?
I am looking for good resources to use to compare the effectiveness of various antivirus/antimalware software solutions. In particular, I am comparing Windows Security Essentials against Symantec ...
-1
votes
1answer
228 views
.htaccess malware detected - where to report? [closed]
just detected some .htaccess malware on one of my servers (shared hosting). The provider (1and1) doesn't seem to care (we take a look into this on monday).
Is there any good place to report this ...
1
vote
2answers
691 views
Linux Stealth Process
I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...
...
11
votes
4answers
1k views
How do I deal with the removal/eradication of an unknown worm on our network?
TL;DR
I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
1
vote
4answers
88 views
sendmail sending mail to recipients I don’t know of; possible spam host
Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday.
STATISTICS
----------
Messages To Recipients: 582
Addressed Recipients: ...
-1
votes
1answer
40 views
How can I uninstall Antivirus Studio 2010 completely? [closed]
Is Antivirus Studio 2010 malware? I found it installed on my computer yesterday, and I try to uninstall it with Control Panel. But I noticed that it is still running! How can I uninstall it ...
-2
votes
2answers
126 views
Good malware removal tool(s) for windows XP/Vista/7? [closed]
The goal for this Wiki is to extablish a list of known good tools for cleaning up those pesky malware / virues that haunt windows clients. What tools do you like and what are their strengths and ...
3
votes
2answers
402 views
Possible malware on my server, how to search the source?
Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears.
The message is something like
"The remote address has ...
2
votes
1answer
1k views
Cisco reputation filters mis-identified site as malware or “misconfigured DNS”
A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
0
votes
1answer
94 views
Security & Malware Protection for Windows 2008 Server (with RDP)
I am running an ASP.NET site on a windows 2008 server with RDP access to the server. Installing or enabling firewalls shuts off my RDP access and multiple other issues. My hosting provider is very ...
3
votes
3answers
122 views
Training High School Students on Security - What harmless “viruses” can I install that they can find?
I'm training some high school students interested in OS security (specifically, Windows Server 2003/2008), and though I've gone over a lot of the "in-theory" stuff, some hands on would be great. ...
0
votes
2answers
435 views
Strange email coming from/to my computer
I'm running smtp4dev on my machine to trap anything going in/out of my computer on port 25 for testing purposes. Every so often this email gets trapped and I have no idea what it's from. I have ...
0
votes
1answer
155 views
windows xp home security Trojan.FakeAlert - virus/scareware/malware
We have just had our second outbreak of a variant of the Windows XP home security malware (malwarebytes called it Trojan.fakeAlert). It manages to kill our antivirus (nod 32), and then kill attempts ...
0
votes
3answers
91 views
Problem for my website, Some attack pages intentionally distribute harmful software [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
Some pages of my website are distributing harmful software. How do I investigate and fix this?
0
votes
4answers
256 views
Portable Malware Scanning Software for Win2008
Is there any malware/spyware/virus scanning software that can be run via USB or other means to scan a windows server 2008? It needs to be something that does not need to be installed.
6
votes
5answers
280 views
Kids + older computers + our network at the office: Security risk?
On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
1
vote
3answers
885 views
Debian webserver malware scanner
I was wondering if there was a malware scanner for websites with up to date exploits for use on a Debian webs server with Apache2.2?
Vulnerability scanners are great, but I also want to be sure that ...
1
vote
1answer
43 views
Administering forums on servers, seeing weird attacks
I'm not sure ServerFault is the correct place for such a question: please redirect if another StackExchange site is more appropriate but I think this is the "most correct" one.
On one of the server ...
0
votes
1answer
91 views
Server redirect malware
I have a linux packaged server (is that right?) that I run for a coworker. It has recently been hacked and I've been trying for the last few days to get rid of the malware. It now redirects most of my ...
0
votes
5answers
110 views
Can anyone think of a way of preventing an XP client from performing DNS lookups for external domains?
As usual, we're trying to tighten security even further in our organisation. The current focus for me is the possibility of a compromised XP client from using DNS lookups as a command/control channel ...
1
vote
2answers
31 views
Need a resource to find out about latest attack activity?
Thought about this seeing another question pop up about a user agent string showing up in the poster's logs; is there a site for sysadmins to go to for finding the latest information about ...
0
votes
1answer
149 views
hiden iframe unescape
started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server:
...
2
votes
1answer
498 views
Find the source of malware?
I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
0
votes
4answers
132 views
Network Security Device/Software
We currently run Symantec Antivirus Corporate 10.2. The software is really easy to manage on a network but the actual virus detection isn't bad but the malware detection is crap.
We recently were ...
1
vote
2answers
96 views
md5sum or sha1sum of legitmate microsoft system files
Is there a database or repository of the legitimate checksums for Microsoft system files? We think we have a 0day on DNS for Windows 2003 SP2 using IRC for command and control. (Latest McAfee does not ...
1
vote
3answers
94 views
What sites/publications are good for staying current on security and malware trends? [duplicate]
Possible Duplicate:
Security Resources
In my ever expanding quest for knowledge, I'm at the point where I feel like I need to be more up to date with the current security trends, as well as ...
