"Malware" is a portmanteau of "malicious" and "software" Common forms of malware include: Botnet clients, which grant the malware author some degree of control over the compromised operating system and are generally employed in sending spam e-mail and may be rented out to perform DDoS attacks. ...
1
vote
1answer
36 views
Identifiying weird chinese registry entries in CurrentControlSet\Services
I noticed chinese characters inside my register under HKLM\System\CurrentControlSet\Services. Inside these there was nothing. I googled the strings and found nothing. Anyway for me to identify these? ...
0
votes
1answer
35 views
identity and rectify port scanning activities on CentOS
My Linux (CentOS 5.x) machine seem to have been attacked. Port scanning activities were traced to it. However, the ports (to be) scanned were only 8080. As a temporary measure, I have updated the ...
0
votes
2answers
117 views
Malware on my server [closed]
Possible Duplicate:
My server's been hacked EMERGENCY
Upon going to a couple of our websites this morning that we host for clients and have designed ourselves, I was prompted by Chrome ...
1
vote
2answers
82 views
One machine blocked from a single server, and only when it's at this physical location?
I host an e-commerce website for a client who suddenly is unable to access it from his computer. He can ping the server, he can SSH in, but cannot load the website in any browser we've tried: IE, ...
0
votes
2answers
47 views
strange tcp network connections 149.9.1.16:ircd [closed]
Possible Duplicate:
My server's been hacked EMERGENCY
I am seeing strange tcp connection 149.9.1.16:ircd ans it is running perl service
and that process is creating huge load on server
...
0
votes
1answer
33 views
Good resource for evaluting AV and anti Malware software?
I am looking for good resources to use to compare the effectiveness of various antivirus/antimalware software solutions. In particular, I am comparing Windows Security Essentials against Symantec ...
1
vote
1answer
107 views
.htaccess malware detected - where to report?
just detected some .htaccess malware on one of my servers (shared hosting). The provider (1and1) doesn't seem to care (we take a look into this on monday).
Is there any good place to report this ...
1
vote
2answers
301 views
Linux Stealth Process
I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...
...
6
votes
4answers
974 views
How do I deal with the removal/eradication of an unknown worm on our network?
TL;DR
I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
1
vote
4answers
55 views
sendmail sending mail to recipients I don’t know of; possible spam host
Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday.
STATISTICS
----------
Messages To Recipients: 582
Addressed Recipients: ...
0
votes
0answers
50 views
Malware and Virus Protection with System Center Essentials
We have a pretty small MS network (currently about 5 servers and 20 clients) and have just started using System Center Essentials (SCE) to monitor the health of our network and centralise deployment ...
-1
votes
1answer
38 views
How can I uninstall Antivirus Studio 2010 completely? [closed]
Is Antivirus Studio 2010 malware? I found it installed on my computer yesterday, and I try to uninstall it with Control Panel. But I noticed that it is still running! How can I uninstall it ...
-2
votes
2answers
102 views
Good malware removal tool(s) for windows XP/Vista/7? [closed]
The goal for this Wiki is to extablish a list of known good tools for cleaning up those pesky malware / virues that haunt windows clients. What tools do you like and what are their strengths and ...
2
votes
2answers
220 views
Possible malware on my server, how to search the source?
Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears.
The message is something like
"The remote address has ...
1
vote
1answer
462 views
Website mis-identified as malware for “misconfigured DNS”
A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
0
votes
1answer
34 views
Security & Malware Protection for Windows 2008 Server (with RDP)
I am running an ASP.NET site on a windows 2008 server with RDP access to the server. Installing or enabling firewalls shuts off my RDP access and multiple other issues. My hosting provider is very ...
3
votes
3answers
108 views
Training High School Students on Security - What harmless “viruses” can I install that they can find?
I'm training some high school students interested in OS security (specifically, Windows Server 2003/2008), and though I've gone over a lot of the "in-theory" stuff, some hands on would be great. ...
0
votes
2answers
226 views
Strange email coming from/to my computer
I'm running smtp4dev on my machine to trap anything going in/out of my computer on port 25 for testing purposes. Every so often this email gets trapped and I have no idea what it's from. I have ...
0
votes
1answer
132 views
windows xp home security Trojan.FakeAlert - virus/scareware/malware
We have just had our second outbreak of a variant of the Windows XP home security malware (malwarebytes called it Trojan.fakeAlert). It manages to kill our antivirus (nod 32), and then kill attempts ...
0
votes
3answers
85 views
Problem for my website, Some attack pages intentionally distribute harmful software [closed]
Possible Duplicate:
My server's been hacked EMERGENCY
Some pages of my website are distributing harmful software. How do I investigate and fix this?
0
votes
4answers
100 views
Portable Malware Scanning Software for Win2008
Is there any malware/spyware/virus scanning software that can be run via USB or other means to scan a windows server 2008? It needs to be something that does not need to be installed.
6
votes
5answers
251 views
Kids + older computers + our network at the office: Security risk?
On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
1
vote
3answers
296 views
Debian webserver malware scanner
I was wondering if there was a malware scanner for websites with up to date exploits for use on a Debian webs server with Apache2.2?
Vulnerability scanners are great, but I also want to be sure that ...
1
vote
1answer
40 views
Administering forums on servers, seeing weird attacks
I'm not sure ServerFault is the correct place for such a question: please redirect if another StackExchange site is more appropriate but I think this is the "most correct" one.
On one of the server ...
0
votes
1answer
77 views
Server redirect malware
I have a linux packaged server (is that right?) that I run for a coworker. It has recently been hacked and I've been trying for the last few days to get rid of the malware. It now redirects most of my ...
0
votes
5answers
103 views
Can anyone think of a way of preventing an XP client from performing DNS lookups for external domains?
As usual, we're trying to tighten security even further in our organisation. The current focus for me is the possibility of a compromised XP client from using DNS lookups as a command/control channel ...
1
vote
2answers
27 views
Need a resource to find out about latest attack activity?
Thought about this seeing another question pop up about a user agent string showing up in the poster's logs; is there a site for sysadmins to go to for finding the latest information about ...
0
votes
1answer
133 views
hiden iframe unescape
started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server:
...
2
votes
1answer
322 views
Find the source of malware?
I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
0
votes
4answers
120 views
Network Security Device/Software
We currently run Symantec Antivirus Corporate 10.2. The software is really easy to manage on a network but the actual virus detection isn't bad but the malware detection is crap.
We recently were ...
1
vote
2answers
80 views
md5sum or sha1sum of legitmate microsoft system files
Is there a database or repository of the legitimate checksums for Microsoft system files? We think we have a 0day on DNS for Windows 2003 SP2 using IRC for command and control. (Latest McAfee does not ...
1
vote
3answers
80 views
What sites/publications are good for staying current on security and malware trends? [closed]
Possible Duplicate:
Security Resources
In my ever expanding quest for knowledge, I'm at the point where I feel like I need to be more up to date with the current security trends, as well as ...
0
votes
4answers
309 views
Malware vs Viruses
Is there a legitimate technical difference between malware and viruses? I have looked at the Wikipedia entries but I am not really seeing the difference.
Currently, I kind of feel like this is just ...
0
votes
3answers
775 views
My website is infected with JS:ScriptIP-inf [Trj]
I am using Network Solutions hosting. I was recently attacked with JS:Illredir-S [Trj], I asked my hosting providers to clean it and they cleaned it and updated all passwords, but now after a week my ...
1
vote
8answers
662 views
anti-virus / malware solution for small non-profit network
I'm an IT volunteer at a local non-profit. I'm looking for a good AV/malware solution.
We currently use a mishmash of different client solutions, and want to move to something centralized. There is ...
3
votes
4answers
770 views
Should I upgrade to Symantec Endpoint Protection? [closed]
I'm the IT manager at an animal shelter in Upstate New York. We have a Windows network with about 50 desktops running Windows XP Pro. We used to use CA eTrust Antivirus, but that product didn't work ...
8
votes
5answers
244 views
Securing Acrobat Reader to mitigate viruses
Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...
1
vote
2answers
96 views
What's your attitude towards malware-friendly hosting providers?
Last week I had to deal with the following situation: some of my users complained that they got emails telling them that their computers are infected and they should go to a certain site for a free ...
2
votes
3answers
85 views
Suggestions requested on what to cover in seminar on `Recent Trends in Virus & Anti-virus Stratagies`
I'm going to give a seminar on "Recent Trends in Virus & Anti-virus Strategies" as a part of my course work in my Post Graduation. I got two months of time. So, I want to fully utilize this ...
0
votes
2answers
246 views
Heeeelp! False positives from ZoneAlarm Force Field on my website will scare users away
I recently helped create a website for a conference that I am helping to host. We mailed out about 30,000 brochures and are expecting the big wave of traffic to start in a day or two. However, we keep ...
0
votes
2answers
517 views
Malicious Script on LAMP Server
We have recently noticed that a malicious script is inserting itself in a number of PHP and HTML files on our domain questoons.com and the various add-on domains hosted on this account. The script ...
3
votes
7answers
344 views
Users as local admins on Windows machines
I am in charge of a Windows-based network of over 70 computers at work. Servers are Windows Server 2008 and workstations are Windows Vista and Windows XP.
Most users are researchers, and some of them ...
2
votes
5answers
343 views
Has our site been hacked? Google says we are malware! HELP
We receieved an email direct from google this morning, stating that our site is carrying malware. We are a respectful marketing company with no dodgy code or links to malware on our site.
We now have ...
4
votes
1answer
369 views
Is it possible to hide a malicious alias in Bash on Linux?
Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
1
vote
1answer
32 views
malicious files
can virus's/spyware/malware/trojans/worms get on your remote desktop/terminal services servers from a local machine?
1
vote
2answers
448 views
Best practices for isolating malware/honeypot samples
I am pursuing malware research and am wondering what are the best practices for building safe VM's to contain the code while disassembling it. So far:
Each instance for examining the code is housed ...
1
vote
3answers
147 views
Is it normal for port 23 to be connected to periodically?
While working at a customer site (a LAN that includes several Windows machines, plus our server) I noticed that something was periodically attempting to connect to our server on port 23 via TCP.
...
5
votes
8answers
978 views
How can I test if a website is infected with malware?
Some friends of mine have a website (www.kennelsoffie.dk) and I'm trying to help them when there is any trouble. However this time I, can't figure it out. When I visit the site using Google Chrome, ...
6
votes
12answers
595 views
Hardening a financially critical Windows computer
One of the risks to small and medium businesses is losing your bank credentials to bad guys by use of a key logger or other malware as Bruce Schneier blogs about. A particular threat is real-time key ...
0
votes
3answers
223 views
Symantec - Flagging every local HTML file on my computer as a virus
I just ran Symantec Anti-Virus and it's flagging literally every since HTML,PHP,ASP/ASPX file on my computer as a virus. That's nearly 600 files on my laptop.
Can this be? How can a text file ...
