Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
1answer
73 views

Locating malware on network

I am trying to isolate an email sending malware on my network. The headers are as follows: Received: from z.local.domain (172.18.248.22) by z.local.domain (172.18.248.22) with Microsoft SMTP Server ...
1
vote
2answers
252 views

Mac server infected with spam agent

We have a huge trouble :( .. Our mac server makes a spam delivery. Our IP already blacklisted in about a dozen of servers (checked with http://mxtoolbox.com/). We have another computers in the same ...
0
votes
1answer
272 views

Almost all of our websites within our server is redirecting to a porno scammy sites [duplicate]

We are having a problem within our server. After transferring the files to a new dedicated server, within only one or two weeks almost every website under our server is redirecting to a porno scammy ...
1
vote
0answers
267 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
0
votes
0answers
45 views

BIND Configuration for malware analysis

we are working on a project to analyse the traffic generated by bots in a enterprise network isolated from internet. I would like to configure the BIND in this network to direct all otherwise ...
0
votes
1answer
3k views

How to get rid of ebury malware / trojan on Centos / cpanel [duplicate]

I have a server with cPanel installed on Centos 5.9. Three days ago, my server provider told me I'm infected by "Ebury Trojan". I read a lot of things saying that the openSSH server coming with ...
0
votes
0answers
202 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...
-1
votes
1answer
59 views

Site blocked by google [closed]

I have my site that was hackered. I have removed all files and reloaded clean old files without the hacked code. Now when I use Google Chrome, I can't access my site because is shows as blocked. How ...
-5
votes
1answer
56 views

Why is the Anti Virus Definition file only 200MBs? [closed]

So I downloaded a virus definition file for symantec endpoint protection. We regularly update our client's closed network anti virus using these files once every 6 months. The files are of '.JDB' ...
3
votes
2answers
1k views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
1
vote
2answers
45 views

Do these files look like virus remnants?

We've been having Backup Exec issues related to a corrupt file within SYSVOL on an SBS 2008 server. An anti-virus scan removed a file (the same one BE was failing on) from within the scripts folder as ...
0
votes
3answers
69 views

watch file to see whos accessing/writing it and log it

I am facing some malware problems on my webserver. I updated third party software such as Wordpress to the latest version, disabled root logins and my users password complex enough but still someone ...
-3
votes
1answer
320 views

How to prevent non-power-users with admin rights from accidentally installing adware on community pc [closed]

I am going to describe my problem and solution to prevent non-power-users installing unwanted software along with other software (adware installed through pre-set checkboxes in a "desired software ...
0
votes
1answer
368 views

Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role

Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this: The message repeats every second and the port number is increased by one the range ...
0
votes
1answer
82 views

Malicious HTTP Post reuqest decoding

I have this request in my traffic, which is posting data to a malicious php file. T 212.193.229.17:60601 -> 9.9.9.9:80 [A] POST /images//sh.php HTTP/1.0. Host: dpfremovalwarrington.co.uk. ...
1
vote
2answers
771 views

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of ...
0
votes
1answer
205 views

Centos5 /tmp/.xzibit Displays multiple viruses in clamav, Can I delete this directory safely? [duplicate]

Possible Duplicate: How do I deal with a compromised server? I did a scan on my entire vps finding the folder above with a good amount of viruses. Can I safely delete this folder? Can I ...
0
votes
1answer
103 views

Trying to hunt down malware on my server [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY A server of mine recently suffered a malware attack. I've since cleaned the server up a bit, upgraded a variety of wordpress installs ...
0
votes
0answers
76 views

Mass targeted malware installed - g00glestatic.com [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I run a webserver which over the last few days seems to have become infected with malware that tries to include content from ...
1
vote
2answers
706 views

How to find any file that is an executable or library

Let's say someone provides you with a tarball, saying it is source code and nothing else. You want to make sure that is true, and that no virus-laden executables or libraries are tucked away in a ...
0
votes
1answer
75 views

Compromised web server/multiple domains [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY Earlier today I found a lot of weird files on one of my servers (running Ubuntu Server 10.04), which I can't understand how they got ...
-2
votes
1answer
307 views

Malware removal from the code [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY My web application has been hacked and trying to remove the malware/code injection. Scanning it through http://sitecheck.sucuri.net ...
0
votes
1answer
250 views

Google and Yahoo redirect my site to malware, but direct url works fine. Any computer [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I can go directly to the site doublewing.org or www. without issue, but if I click on the link in google or yahoo it redirects to spam ...
1
vote
1answer
219 views

String search and replace across an entire database

After an exploit on an ASP.NET site, the client was left with a specific string of malware code sprayed across the entire database, multiple columns of multiple tables. The prepended string is ...
0
votes
1answer
88 views

Our clients site is redirecting to a pill scammy site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We've usually host our clients site, but we aren't hosting this one. The website itself (weddle-funeral.com) works just fine. if ...
1
vote
1answer
2k views

Folders on our server2003-share are being “hidden”, replaced by .exe files

We have had following problem on our Windows2003 server for weeks now, every day the folder on our share are being made hidden and replaced by .exe files with the same names as the original folders. I ...
0
votes
1answer
153 views

What is causing ping sweep?

I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server. The traffic shows sequential pings sent to private ranges only. Eg: 192.168.1.1 192.168.1.2 192.168.1.3 ...
0
votes
1answer
1k views

Anti-Malware Antivirus for Linux Web Server? [closed]

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
1
vote
1answer
105 views

Hyper-V or VMware - Find all modifications/changes made between 2 Snapshots

I would like to use either Hyper-V or Vmware in order to find out after taking a Clean Base snapshot and a modified snapshot and what the modifications/differences and what was changed between the two ...
0
votes
1answer
559 views

Allowing any file to upload on server and security risks

We are having a project that allows users to backup there data to server through php upload,running on Linux server. If users upload any executable file it will be automatically renamed to some ...
2
votes
6answers
2k views

Websites on Ubuntu 8.04 LTS with Plesk are infected with viruses [duplicate]

I am running Plesk 9.5 on Ubuntu 8.04 LTS and have about 15 websites infected with some malicious code appended to the end of java files. I have installed Clamav and it has managed to pickup the ...
2
votes
2answers
277 views

Why computer scanning network?

I have found out through Wireshark that a computer in my subnet scanning network ( sending ARPs for every IP-address in my subnet. Even if there no computers with such address). It repeats ...
1
vote
2answers
2k views

Got a malware on my hosting provider which infect JavaScript files .. how do I find the entry point?

This morning some sites which are hosted on the server as me started triggering malware alerts and started to redirect traffic to external sites. I've found out that a line of packed javascript was ...
2
votes
1answer
518 views

Does windows 7 remember shared folder passwords to entire server instead of by share?

So I have a copy of Windows 7 Enterprise edition on my home computer. I've connected from the home computer to a network share on my windows 2003 server at work before. I assume that I told it to ...
2
votes
1answer
549 views

I have many strange requests in my httpd access_log, does it mean I have a virus?

I have httpd log information as such which goes on and on forever. Firstly, does this mean I have a virus? is my server part of a botnet? My server is Linux Centos 5. tail -f ...
-3
votes
2answers
677 views

Rootkit scanning

Are there any good services or ways to scan for rootkits and backdoors? I know there are rkhunter and chkrootkit but are they even ideal anymore? They never seem updated and look more like they were ...
2
votes
4answers
4k views

HP Printer Malfunction (Virus?)

i'm having serious problems with several HP Printers. The issue is the following: my printer (different models) prints random ASCII character on the first line of a paper ( image sample: ...
-1
votes
1answer
75 views

Malicious program changing my DNSs [closed]

Some weeks ago I started having problems with my internet connection, it was extremely slow and suddently some websites (specifically gmail, facebook, youtube and twitter) started failing to connect, ...
-3
votes
1answer
149 views

How do I remove a rootkit without an anti-rootkit program? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Windows 2000 Server. I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely ...
1
vote
1answer
405 views

Identifiying weird chinese registry entries in CurrentControlSet\Services

I noticed chinese characters inside my register under HKLM\System\CurrentControlSet\Services. Inside these there was nothing. I googled the strings and found nothing. Anyway for me to identify these? ...
-1
votes
1answer
139 views

Virus creates exe files with text content [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Something automatically creates exe files like "zytudou.exe" on my PC with text content: open 122.138.203.175 123 123 get ...
1
vote
3answers
939 views

Recurring virus infection on a domain workstation

One of our users is having a recurring problem with a virus. It has happened to this user on two different machines, in each instance infecting the same program with the same virus. Malware bytes ...
0
votes
1answer
720 views

identity and rectify port scanning activities on CentOS [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux (CentOS 5.x) machine seem to have been attacked. Port scanning activities were traced to it. However, the ports (to be) ...
1
vote
2answers
52 views

Program to log when files are written to a folder

One of our companies server seems to have fallen victim to a php backdoor attack. I've managed to located and close several holes, but one seems to persist that is writing a php/webshell backdoor ...
1
vote
3answers
1k views

Scan whole system or just user dirs with clamav

I'm in doubt about how to scan my Linux system with Clamav: do I just scan the places where users can upload files (homedirs, their webroots) or do I scan the whole system? The various sites I've ...
1
vote
2answers
240 views

One machine blocked from a single server, and only when it's at this physical location?

I host an e-commerce website for a client who suddenly is unable to access it from his computer. He can ping the server, he can SSH in, but cannot load the website in any browser we've tried: IE, ...
0
votes
2answers
91 views

strange tcp network connections 149.9.1.16:ircd [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I am seeing strange tcp connection 149.9.1.16:ircd ans it is running perl service and that process is creating huge load on server ...
0
votes
1answer
85 views

Good resource for evaluting AV and anti Malware software?

I am looking for good resources to use to compare the effectiveness of various antivirus/antimalware software solutions. In particular, I am comparing Windows Security Essentials against Symantec ...
-1
votes
1answer
252 views

.htaccess malware detected - where to report? [closed]

just detected some .htaccess malware on one of my servers (shared hosting). The provider (1and1) doesn't seem to care (we take a look into this on monday). Is there any good place to report this ...
0
votes
1answer
568 views

Critical Virus infection with PHP website. What are the options to remove Virus? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have a critical virus infection to one of my website. There is a additional script found added at footer of few web pages . the ...