"Malware" is a portmanteau of "malicious" and "software" Common forms of malware include: Botnet clients, which grant the malware author some degree of control over the compromised operating system and are generally employed in sending spam e-mail and may be rented out to perform DDoS attacks. ...
1
vote
2answers
175 views
Linux Stealth Process
I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...
...
5
votes
4answers
936 views
How do I deal with the removal/eradication of an unknown worm on our network?
TL;DR
I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
1
vote
4answers
51 views
sendmail sending mail to recipients I don’t know of; possible spam host
Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday.
STATISTICS
----------
Messages To Recipients: 582
Addressed Recipients: ...
0
votes
0answers
38 views
Malware and Virus Protection with System Center Essentials
We have a pretty small MS network (currently about 5 servers and 20 clients) and have just started using System Center Essentials (SCE) to monitor the health of our network and centralise deployment ...
-1
votes
1answer
38 views
How can I uninstall Antivirus Studio 2010 completely? [closed]
Is Antivirus Studio 2010 malware? I found it installed on my computer yesterday, and I try to uninstall it with Control Panel. But I noticed that it is still running! How can I uninstall it ...
-2
votes
2answers
97 views
Good malware removal tool(s) for windows XP/Vista/7? [closed]
The goal for this Wiki is to extablish a list of known good tools for cleaning up those pesky malware / virues that haunt windows clients. What tools do you like and what are their strengths and ...
2
votes
2answers
149 views
Possible malware on my server, how to search the source?
Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears.
The message is something like
"The remote address has ...
1
vote
1answer
336 views
Website mis-identified as malware for “misconfigured DNS”
A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
0
votes
1answer
23 views
Security & Malware Protection for Windows 2008 Server (with RDP)
I am running an ASP.NET site on a windows 2008 server with RDP access to the server. Installing or enabling firewalls shuts off my RDP access and multiple other issues. My hosting provider is very ...
3
votes
3answers
105 views
Training High School Students on Security - What harmless “viruses” can I install that they can find?
I'm training some high school students interested in OS security (specifically, Windows Server 2003/2008), and though I've gone over a lot of the "in-theory" stuff, some hands on would be great. ...
0
votes
2answers
158 views
Strange email coming from/to my computer
I'm running smtp4dev on my machine to trap anything going in/out of my computer on port 25 for testing purposes. Every so often this email gets trapped and I have no idea what it's from. I have ...
0
votes
1answer
121 views
windows xp home security Trojan.FakeAlert - virus/scareware/malware
We have just had our second outbreak of a variant of the Windows XP home security malware (malwarebytes called it Trojan.fakeAlert). It manages to kill our antivirus (nod 32), and then kill attempts ...
0
votes
3answers
84 views
Problem for my website, Some attack pages intentionally distribute harmful software [closed]
Possible Duplicate:
My server's been hacked EMERGENCY
Some pages of my website are distributing harmful software. How do I investigate and fix this?
0
votes
4answers
82 views
Portable Malware Scanning Software for Win2008
Is there any malware/spyware/virus scanning software that can be run via USB or other means to scan a windows server 2008? It needs to be something that does not need to be installed.
6
votes
5answers
241 views
Kids + older computers + our network at the office: Security risk?
On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
0
votes
3answers
206 views
Debian webserver malware scanner
I was wondering if there was a malware scanner for websites with up to date exploits for use on a Debian webs server with Apache2.2?
Vulnerability scanners are great, but I also want to be sure that ...
1
vote
1answer
39 views
Administering forums on servers, seeing weird attacks
I'm not sure ServerFault is the correct place for such a question: please redirect if another StackExchange site is more appropriate but I think this is the "most correct" one.
On one of the server ...
0
votes
1answer
71 views
Server redirect malware
I have a linux packaged server (is that right?) that I run for a coworker. It has recently been hacked and I've been trying for the last few days to get rid of the malware. It now redirects most of my ...
0
votes
5answers
102 views
Can anyone think of a way of preventing an XP client from performing DNS lookups for external domains?
As usual, we're trying to tighten security even further in our organisation. The current focus for me is the possibility of a compromised XP client from using DNS lookups as a command/control channel ...
1
vote
2answers
26 views
Need a resource to find out about latest attack activity?
Thought about this seeing another question pop up about a user agent string showing up in the poster's logs; is there a site for sysadmins to go to for finding the latest information about ...
0
votes
1answer
119 views
hiden iframe unescape
started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server:
...
2
votes
1answer
276 views
Find the source of malware?
I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
0
votes
4answers
116 views
Network Security Device/Software
We currently run Symantec Antivirus Corporate 10.2. The software is really easy to manage on a network but the actual virus detection isn't bad but the malware detection is crap.
We recently were ...
1
vote
2answers
75 views
md5sum or sha1sum of legitmate microsoft system files
Is there a database or repository of the legitimate checksums for Microsoft system files? We think we have a 0day on DNS for Windows 2003 SP2 using IRC for command and control. (Latest McAfee does not ...
1
vote
3answers
78 views
What sites/publications are good for staying current on security and malware trends? [closed]
Possible Duplicate:
Security Resources
In my ever expanding quest for knowledge, I'm at the point where I feel like I need to be more up to date with the current security trends, as well as ...
0
votes
4answers
284 views
Malware vs Viruses
Is there a legitimate technical difference between malware and viruses? I have looked at the Wikipedia entries but I am not really seeing the difference.
Currently, I kind of feel like this is just ...
0
votes
3answers
683 views
My website is infected with JS:ScriptIP-inf [Trj]
I am using Network Solutions hosting. I was recently attacked with JS:Illredir-S [Trj], I asked my hosting providers to clean it and they cleaned it and updated all passwords, but now after a week my ...
1
vote
8answers
597 views
anti-virus / malware solution for small non-profit network
I'm an IT volunteer at a local non-profit. I'm looking for a good AV/malware solution.
We currently use a mishmash of different client solutions, and want to move to something centralized. There is ...
3
votes
4answers
719 views
Should I upgrade to Symantec Endpoint Protection? [closed]
I'm the IT manager at an animal shelter in Upstate New York. We have a Windows network with about 50 desktops running Windows XP Pro. We used to use CA eTrust Antivirus, but that product didn't work ...
8
votes
5answers
233 views
Securing Acrobat Reader to mitigate viruses
Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...
1
vote
2answers
96 views
What's your attitude towards malware-friendly hosting providers?
Last week I had to deal with the following situation: some of my users complained that they got emails telling them that their computers are infected and they should go to a certain site for a free ...
2
votes
3answers
82 views
Suggestions requested on what to cover in seminar on `Recent Trends in Virus & Anti-virus Stratagies`
I'm going to give a seminar on "Recent Trends in Virus & Anti-virus Strategies" as a part of my course work in my Post Graduation. I got two months of time. So, I want to fully utilize this ...
0
votes
2answers
236 views
Heeeelp! False positives from ZoneAlarm Force Field on my website will scare users away
I recently helped create a website for a conference that I am helping to host. We mailed out about 30,000 brochures and are expecting the big wave of traffic to start in a day or two. However, we keep ...
0
votes
2answers
510 views
Malicious Script on LAMP Server
We have recently noticed that a malicious script is inserting itself in a number of PHP and HTML files on our domain questoons.com and the various add-on domains hosted on this account. The script ...
3
votes
7answers
334 views
Users as local admins on Windows machines
I am in charge of a Windows-based network of over 70 computers at work. Servers are Windows Server 2008 and workstations are Windows Vista and Windows XP.
Most users are researchers, and some of them ...
2
votes
5answers
324 views
Has our site been hacked? Google says we are malware! HELP
We receieved an email direct from google this morning, stating that our site is carrying malware. We are a respectful marketing company with no dodgy code or links to malware on our site.
We now have ...
4
votes
1answer
342 views
Is it possible to hide a malicious alias in Bash on Linux?
Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
1
vote
1answer
31 views
malicious files
can virus's/spyware/malware/trojans/worms get on your remote desktop/terminal services servers from a local machine?
1
vote
2answers
422 views
Best practices for isolating malware/honeypot samples
I am pursuing malware research and am wondering what are the best practices for building safe VM's to contain the code while disassembling it. So far:
Each instance for examining the code is housed ...
1
vote
3answers
144 views
Is it normal for port 23 to be connected to periodically?
While working at a customer site (a LAN that includes several Windows machines, plus our server) I noticed that something was periodically attempting to connect to our server on port 23 via TCP.
...
5
votes
8answers
791 views
How can I test if a website is infected with malware?
Some friends of mine have a website (www.kennelsoffie.dk) and I'm trying to help them when there is any trouble. However this time I, can't figure it out. When I visit the site using Google Chrome, ...
6
votes
12answers
575 views
Hardening a financially critical Windows computer
One of the risks to small and medium businesses is losing your bank credentials to bad guys by use of a key logger or other malware as Bruce Schneier blogs about. A particular threat is real-time key ...
0
votes
3answers
217 views
Symantec - Flagging every local HTML file on my computer as a virus
I just ran Symantec Anti-Virus and it's flagging literally every since HTML,PHP,ASP/ASPX file on my computer as a virus. That's nearly 600 files on my laptop.
Can this be? How can a text file ...
1
vote
3answers
197 views
XP Pro SP3 unresponsive requires power down
New to serverfault, but searched google and the forums here and haven't found anything regarding my issue.
I have two laptops in my network that are displaying similar issues. They are from different ...
0
votes
3answers
134 views
Site harmed by malware -or is it a server problem?
I have a site which is got harmed by this "spywarepc.info" and showing
"Your site has been attacked by a
Malware"
:( ... don't even know what is this ? so i have opened spywarepc.info in a ...
8
votes
4answers
598 views
Updating Malware cleaning skills
I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
1
vote
7answers
2k views
I am starting to think that Prevx.com isnt a legit site…but heres my long-winded question
I apologize in advance for the long-winded post. I posted it all because I believe its informative and may be useful. Also, I posted my question at the end.
Moments ago I was RDC to a file server ...
1
vote
11answers
229 views
Bad results from malware cleanup tools?
As there's already a wiki regarding cleanup tools, are there any tools that have given you negative results (i.e. made the system worse)?
4
votes
6answers
2k views
Best Open Source or Freeware Malware/Spyware/Antivirus with centralized managment?
What are the best Malware/Spyware/Antivirus solutions ?
Several requirements for the solution:
Open Source or Freeware
Centralized Management
Reporting and Remote Installation
Think spybot / ...
2
votes
3answers
187 views
Data Execution Prevention has closed the program Ms08n.exe
I've got a Windows2003 server which I rebooted recently, and now is nagging me about Data Execution Prevention having closed the program "Ms08n.exe". When I press "close message", the dialog just ...
