Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

1
vote
3answers
59 views

Blocking Invalid HTTP Requests to PHP Application

For the first time in a number of years, I'm semi-responsible for helping out with the server administration of a PHP web application (served out using Apache). We're seeing a number of requests for ...
0
votes
0answers
13 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
3
votes
2answers
105 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
0
votes
2answers
737 views

High CPU load on Centos with process sync_supers

My centos server has high cpu load right now. Please see the Htop output below. sync_supers is very suspected but I don't know how to kill it. Any suggestions?
1
vote
2answers
47 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
-1
votes
1answer
438 views

Getting rid of Trojan on Debian Server [duplicate]

-------- EDIT --------- I do not agree that this is a duplicate of the linked question. I know that the correct way to deal with this is to wipe and reinstall the server. However, i am interested in ...
-1
votes
1answer
155 views

My website redirects to malware link [duplicate]

I coded my own website and uploaded to a host. Some days ago I realized that in front page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects ends up at: ...
0
votes
1answer
52 views

How to add wildcards to Linux Malware Detect ignore_paths

I am using Linux Malware Detect to scan and report on malware, but on a daily basis I receive alerts for malware in users emails (mainly spam folder). I do not want alerts for this, the spam folders ...
0
votes
0answers
34 views

Maldetect Ignore List Not Being Honoured

I'm using Maldetect on CentOS to scan for malware on my server. I have hundreds of thousands of audio files on my server which I do not want scanned. According to the README: ...
1
vote
1answer
38 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
1answer
53 views

Host says server is affected by malware, anyone knows this one ? What to do? [duplicate]

My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS. Anyone ...
1
vote
1answer
78 views

malware infected server respawing of files [duplicate]

So I have a clients server that is infected with malware. Basically any index.php file on the server was infected as well as header.php, function.php. The infection seems to be primarily wordpress ...
0
votes
1answer
90 views

What are best practices for defense against CryptoLocker type threats in an Active Directory environment?

What are best practices for defense against CryptoLocker type threats in an Active Directory environment? Are there Group Policies that could help? NTFS permissions? Anti-virus software?
0
votes
1answer
49 views

How to view traffic operating on a specific port without plugging into egress interface? (Cisco IOS)

I'm trying to track down what host is infected with ZeroAccess on my network. It runs on ports 16464-16471. I would like to find this host without having to connect my laptop to the egress (WAN) ...
0
votes
2answers
471 views

How do I remove 1 line of code from PHP files containing a specific string? [duplicate]

By coincidence I noticed that quite some of the PHP files of the sites I host have had malware injected: They all have the following line before the original/correct code: <?php ...
2
votes
1answer
166 views

WMI query of DNS shows a root hint that's not present in the DNS plugin.

I was writing a Powershell script for my network when I came across some alarming information in our DNS. Bear in mind we still use Powershell v2, not v3. So I have to query DNS via the Get-WMI ...
10
votes
7answers
1k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
2
votes
1answer
173 views

Does anyone recognize this e-mail sniffer or malware using ROT13 encoding?

I have a private website that every week sends e-mails with two different http links to a group of around 30 people. When a link is clicked, the answer is registered in a database. Starting last week, ...
0
votes
0answers
261 views

Suspicious “sys0972500-1.php”, I didn't put it on my server

Before 2 days I found inside the httpdocc a new folder which name was css. Inside this folder I found a file named sys0972500-1.php , which it caused send thousands spam emails from my server. I ...
0
votes
1answer
786 views

group policy exception to disallowed

I'm trying to setup a group policy on a domain to block cryptolocker (among others). I'm mostly following the Cryptolocker Prevention Kit ...
0
votes
1answer
82 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
1
vote
0answers
33 views

Windows app not allowing debugging

I'll start by saying, I am not sure if this should go in StackOverflow or ServerFault. I posted it in StackOverflow earlier, but its been getting votes to close the question, so I assume it should be ...
0
votes
1answer
71 views

Locating malware on network

I am trying to isolate an email sending malware on my network. The headers are as follows: Received: from z.local.domain (172.18.248.22) by z.local.domain (172.18.248.22) with Microsoft SMTP Server ...
1
vote
2answers
201 views

Mac server infected with spam agent

We have a huge trouble :( .. Our mac server makes a spam delivery. Our IP already blacklisted in about a dozen of servers (checked with http://mxtoolbox.com/). We have another computers in the same ...
0
votes
1answer
241 views

Almost all of our websites within our server is redirecting to a porno scammy sites [duplicate]

We are having a problem within our server. After transferring the files to a new dedicated server, within only one or two weeks almost every website under our server is redirecting to a porno scammy ...
0
votes
0answers
44 views

BIND Configuration for malware analysis

we are working on a project to analyse the traffic generated by bots in a enterprise network isolated from internet. I would like to configure the BIND in this network to direct all otherwise ...
-1
votes
1answer
3k views

How to get rid of ebury malware / trojan on Centos / cpanel [duplicate]

I have a server with cPanel installed on Centos 5.9. Three days ago, my server provider told me I'm infected by "Ebury Trojan". I read a lot of things saying that the openSSH server coming with ...
-1
votes
1answer
58 views

Site blocked by google [closed]

I have my site that was hackered. I have removed all files and reloaded clean old files without the hacked code. Now when I use Google Chrome, I can't access my site because is shows as blocked. How ...
3
votes
2answers
909 views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
0
votes
3answers
68 views

watch file to see whos accessing/writing it and log it

I am facing some malware problems on my webserver. I updated third party software such as Wordpress to the latest version, disabled root logins and my users password complex enough but still someone ...
-3
votes
1answer
304 views

How to prevent non-power-users with admin rights from accidentally installing adware on community pc [closed]

I am going to describe my problem and solution to prevent non-power-users installing unwanted software along with other software (adware installed through pre-set checkboxes in a "desired software ...
0
votes
1answer
316 views

Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role

Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this: The message repeats every second and the port number is increased by one the range ...
0
votes
1answer
82 views

Malicious HTTP Post reuqest decoding

I have this request in my traffic, which is posting data to a malicious php file. T 212.193.229.17:60601 -> 9.9.9.9:80 [A] POST /images//sh.php HTTP/1.0. Host: dpfremovalwarrington.co.uk. ...
1
vote
2answers
673 views

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of ...
0
votes
1answer
103 views

Trying to hunt down malware on my server [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY A server of mine recently suffered a malware attack. I've since cleaned the server up a bit, upgraded a variety of wordpress installs ...
0
votes
0answers
76 views

Mass targeted malware installed - g00glestatic.com [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I run a webserver which over the last few days seems to have become infected with malware that tries to include content from ...
0
votes
1answer
75 views

Compromised web server/multiple domains [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY Earlier today I found a lot of weird files on one of my servers (running Ubuntu Server 10.04), which I can't understand how they got ...
-2
votes
1answer
301 views

Malware removal from the code [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY My web application has been hacked and trying to remove the malware/code injection. Scanning it through http://sitecheck.sucuri.net ...
1
vote
1answer
201 views

String search and replace across an entire database

After an exploit on an ASP.NET site, the client was left with a specific string of malware code sprayed across the entire database, multiple columns of multiple tables. The prepended string is ...
1
vote
1answer
2k views

Folders on our server2003-share are being “hidden”, replaced by .exe files

We have had following problem on our Windows2003 server for weeks now, every day the folder on our share are being made hidden and replaced by .exe files with the same names as the original folders. I ...
0
votes
1answer
1k views

Anti-Malware Antivirus for Linux Web Server? [closed]

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
1
vote
1answer
104 views

Hyper-V or VMware - Find all modifications/changes made between 2 Snapshots

I would like to use either Hyper-V or Vmware in order to find out after taking a Clean Base snapshot and a modified snapshot and what the modifications/differences and what was changed between the two ...
2
votes
2answers
272 views

Why computer scanning network?

I have found out through Wireshark that a computer in my subnet scanning network ( sending ARPs for every IP-address in my subnet. Even if there no computers with such address). It repeats ...
1
vote
2answers
2k views

Got a malware on my hosting provider which infect JavaScript files .. how do I find the entry point?

This morning some sites which are hosted on the server as me started triggering malware alerts and started to redirect traffic to external sites. I've found out that a line of packed javascript was ...
2
votes
1answer
473 views

Does windows 7 remember shared folder passwords to entire server instead of by share?

So I have a copy of Windows 7 Enterprise edition on my home computer. I've connected from the home computer to a network share on my windows 2003 server at work before. I assume that I told it to ...
-3
votes
2answers
667 views

Rootkit scanning

Are there any good services or ways to scan for rootkits and backdoors? I know there are rkhunter and chkrootkit but are they even ideal anymore? They never seem updated and look more like they were ...
1
vote
1answer
374 views

Identifiying weird chinese registry entries in CurrentControlSet\Services

I noticed chinese characters inside my register under HKLM\System\CurrentControlSet\Services. Inside these there was nothing. I googled the strings and found nothing. Anyway for me to identify these? ...
0
votes
1answer
670 views

identity and rectify port scanning activities on CentOS [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux (CentOS 5.x) machine seem to have been attacked. Port scanning activities were traced to it. However, the ports (to be) ...
1
vote
3answers
1k views

Scan whole system or just user dirs with clamav

I'm in doubt about how to scan my Linux system with Clamav: do I just scan the places where users can upload files (homedirs, their webroots) or do I scan the whole system? The various sites I've ...
1
vote
2answers
238 views

One machine blocked from a single server, and only when it's at this physical location?

I host an e-commerce website for a client who suddenly is unable to access it from his computer. He can ping the server, he can SSH in, but cannot load the website in any browser we've tried: IE, ...