Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

3
votes
1answer
275 views

Does anyone recognize this e-mail sniffer or malware using ROT13 encoding?

I have a private website that every week sends e-mails with two different http links to a group of around 30 people. When a link is clicked, the answer is registered in a database. Starting last week, ...
4
votes
1answer
219 views

Server side antivirus or not?

We have basic server-side virus scanning in our datacenter, but it's expensive, uses a considerable amount of CPU cycles, and is annoying to maintain. I'm not looking for a sales-pitch on "better" AV ...
0
votes
0answers
269 views

Suspicious “sys0972500-1.php”, I didn't put it on my server

Before 2 days I found inside the httpdocc a new folder which name was css. Inside this folder I found a file named sys0972500-1.php , which it caused send thousands spam emails from my server. I ...
0
votes
1answer
1k views

group policy exception to disallowed

I'm trying to setup a group policy on a domain to block cryptolocker (among others). I'm mostly following the Cryptolocker Prevention Kit ...
0
votes
1answer
93 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
0
votes
1answer
85 views

Small business server 2011 standard - applications randomly closing for remote desktop users

Small business server 2011 standard - applications randomly closing for remote desktop users I have an issue where when you are connected through remote desktop (doesn't matter whether you have ...
0
votes
1answer
363 views

False positive rate of CBL

We've come into the office (30+ networked systems) this morning to find that our email server is blacklisted on the CBL for: This IP address is infected with, or is NATting for a machine infected ...
1
vote
0answers
34 views

Windows app not allowing debugging

I'll start by saying, I am not sure if this should go in StackOverflow or ServerFault. I posted it in StackOverflow earlier, but its been getting votes to close the question, so I assume it should be ...
0
votes
1answer
78 views

Locating malware on network

I am trying to isolate an email sending malware on my network. The headers are as follows: Received: from z.local.domain (172.18.248.22) by z.local.domain (172.18.248.22) with Microsoft SMTP Server ...
1
vote
2answers
354 views

Mac server infected with spam agent

We have a huge trouble :( .. Our mac server makes a spam delivery. Our IP already blacklisted in about a dozen of servers (checked with http://mxtoolbox.com/). We have another computers in the same ...
0
votes
1answer
294 views

Almost all of our websites within our server is redirecting to a porno scammy sites [duplicate]

We are having a problem within our server. After transferring the files to a new dedicated server, within only one or two weeks almost every website under our server is redirecting to a porno scammy ...
1
vote
0answers
310 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
0
votes
0answers
48 views

BIND Configuration for malware analysis

we are working on a project to analyse the traffic generated by bots in a enterprise network isolated from internet. I would like to configure the BIND in this network to direct all otherwise ...
0
votes
1answer
3k views

How to get rid of ebury malware / trojan on Centos / cpanel [duplicate]

I have a server with cPanel installed on Centos 5.9. Three days ago, my server provider told me I'm infected by "Ebury Trojan". I read a lot of things saying that the openSSH server coming with ...
0
votes
0answers
223 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...
-1
votes
1answer
59 views

Site blocked by google [closed]

I have my site that was hackered. I have removed all files and reloaded clean old files without the hacked code. Now when I use Google Chrome, I can't access my site because is shows as blocked. How ...
-5
votes
1answer
58 views

Why is the Anti Virus Definition file only 200MBs? [closed]

So I downloaded a virus definition file for symantec endpoint protection. We regularly update our client's closed network anti virus using these files once every 6 months. The files are of '.JDB' ...
3
votes
2answers
1k views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
1
vote
2answers
45 views

Do these files look like virus remnants?

We've been having Backup Exec issues related to a corrupt file within SYSVOL on an SBS 2008 server. An anti-virus scan removed a file (the same one BE was failing on) from within the scripts folder as ...
0
votes
3answers
70 views

watch file to see whos accessing/writing it and log it

I am facing some malware problems on my webserver. I updated third party software such as Wordpress to the latest version, disabled root logins and my users password complex enough but still someone ...
-3
votes
1answer
357 views

How to prevent non-power-users with admin rights from accidentally installing adware on community pc [closed]

I am going to describe my problem and solution to prevent non-power-users installing unwanted software along with other software (adware installed through pre-set checkboxes in a "desired software ...
1
vote
1answer
433 views

Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role

Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this: The message repeats every second and the port number is increased by one the range ...
0
votes
1answer
83 views

Malicious HTTP Post reuqest decoding

I have this request in my traffic, which is posting data to a malicious php file. T 212.193.229.17:60601 -> 9.9.9.9:80 [A] POST /images//sh.php HTTP/1.0. Host: dpfremovalwarrington.co.uk. ...
1
vote
2answers
906 views

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of ...
0
votes
1answer
211 views

Centos5 /tmp/.xzibit Displays multiple viruses in clamav, Can I delete this directory safely? [duplicate]

Possible Duplicate: How do I deal with a compromised server? I did a scan on my entire vps finding the folder above with a good amount of viruses. Can I safely delete this folder? Can I ...
0
votes
1answer
103 views

Trying to hunt down malware on my server [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY A server of mine recently suffered a malware attack. I've since cleaned the server up a bit, upgraded a variety of wordpress installs ...
0
votes
0answers
77 views

Mass targeted malware installed - g00glestatic.com [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I run a webserver which over the last few days seems to have become infected with malware that tries to include content from ...
1
vote
2answers
851 views

How to find any file that is an executable or library

Let's say someone provides you with a tarball, saying it is source code and nothing else. You want to make sure that is true, and that no virus-laden executables or libraries are tucked away in a ...
0
votes
1answer
75 views

Compromised web server/multiple domains [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY Earlier today I found a lot of weird files on one of my servers (running Ubuntu Server 10.04), which I can't understand how they got ...
-2
votes
1answer
315 views

Malware removal from the code [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY My web application has been hacked and trying to remove the malware/code injection. Scanning it through http://sitecheck.sucuri.net ...
0
votes
1answer
253 views

Google and Yahoo redirect my site to malware, but direct url works fine. Any computer [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I can go directly to the site doublewing.org or www. without issue, but if I click on the link in google or yahoo it redirects to spam ...
1
vote
1answer
254 views

String search and replace across an entire database

After an exploit on an ASP.NET site, the client was left with a specific string of malware code sprayed across the entire database, multiple columns of multiple tables. The prepended string is ...
0
votes
1answer
88 views

Our clients site is redirecting to a pill scammy site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We've usually host our clients site, but we aren't hosting this one. The website itself (weddle-funeral.com) works just fine. if ...
1
vote
1answer
2k views

Folders on our server2003-share are being “hidden”, replaced by .exe files

We have had following problem on our Windows2003 server for weeks now, every day the folder on our share are being made hidden and replaced by .exe files with the same names as the original folders. I ...
0
votes
1answer
158 views

What is causing ping sweep?

I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server. The traffic shows sequential pings sent to private ranges only. Eg: 192.168.1.1 192.168.1.2 192.168.1.3 ...
0
votes
1answer
1k views

Anti-Malware Antivirus for Linux Web Server? [closed]

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
1
vote
1answer
110 views

Hyper-V or VMware - Find all modifications/changes made between 2 Snapshots

I would like to use either Hyper-V or Vmware in order to find out after taking a Clean Base snapshot and a modified snapshot and what the modifications/differences and what was changed between the two ...
0
votes
1answer
591 views

Allowing any file to upload on server and security risks

We are having a project that allows users to backup there data to server through php upload,running on Linux server. If users upload any executable file it will be automatically renamed to some ...
2
votes
6answers
2k views

Websites on Ubuntu 8.04 LTS with Plesk are infected with viruses [duplicate]

I am running Plesk 9.5 on Ubuntu 8.04 LTS and have about 15 websites infected with some malicious code appended to the end of java files. I have installed Clamav and it has managed to pickup the ...
2
votes
2answers
283 views

Why computer scanning network?

I have found out through Wireshark that a computer in my subnet scanning network ( sending ARPs for every IP-address in my subnet. Even if there no computers with such address). It repeats ...
1
vote
2answers
2k views

Got a malware on my hosting provider which infect JavaScript files .. how do I find the entry point?

This morning some sites which are hosted on the server as me started triggering malware alerts and started to redirect traffic to external sites. I've found out that a line of packed javascript was ...
2
votes
1answer
548 views

Does windows 7 remember shared folder passwords to entire server instead of by share?

So I have a copy of Windows 7 Enterprise edition on my home computer. I've connected from the home computer to a network share on my windows 2003 server at work before. I assume that I told it to ...
2
votes
1answer
579 views

I have many strange requests in my httpd access_log, does it mean I have a virus?

I have httpd log information as such which goes on and on forever. Firstly, does this mean I have a virus? is my server part of a botnet? My server is Linux Centos 5. tail -f ...
-3
votes
2answers
688 views

Rootkit scanning

Are there any good services or ways to scan for rootkits and backdoors? I know there are rkhunter and chkrootkit but are they even ideal anymore? They never seem updated and look more like they were ...
2
votes
4answers
4k views

HP Printer Malfunction (Virus?)

i'm having serious problems with several HP Printers. The issue is the following: my printer (different models) prints random ASCII character on the first line of a paper ( image sample: ...
-1
votes
1answer
75 views

Malicious program changing my DNSs [closed]

Some weeks ago I started having problems with my internet connection, it was extremely slow and suddently some websites (specifically gmail, facebook, youtube and twitter) started failing to connect, ...
-3
votes
1answer
152 views

How do I remove a rootkit without an anti-rootkit program? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Windows 2000 Server. I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely ...
1
vote
1answer
438 views

Identifiying weird chinese registry entries in CurrentControlSet\Services

I noticed chinese characters inside my register under HKLM\System\CurrentControlSet\Services. Inside these there was nothing. I googled the strings and found nothing. Anyway for me to identify these? ...
-1
votes
1answer
144 views

Virus creates exe files with text content [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Something automatically creates exe files like "zytudou.exe" on my PC with text content: open 122.138.203.175 123 123 get ...
1
vote
3answers
1k views

Recurring virus infection on a domain workstation

One of our users is having a recurring problem with a virus. It has happened to this user on two different machines, in each instance infecting the same program with the same virus. Malware bytes ...