Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
2answers
885 views

How to remove .htaccess virus [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Subdomain folder with root folder they write a .htaccess file with this code <IfModule mod_rewrite.c> ...
1
vote
3answers
1k views

Linux Stealth Process

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again... ...
12
votes
4answers
1k views

How do I deal with the removal/eradication of an unknown worm on our network?

TL;DR I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
1
vote
4answers
116 views

sendmail sending mail to recipients I don’t know of; possible spam host

Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday. STATISTICS ---------- Messages To Recipients: 582 Addressed Recipients: ...
1
vote
0answers
91 views

SBS client can suddenly not access Internet, had Kryptik trojan

I have a question regarding Windows Small Business Server 2011. Yesterday, one of the computers in our domain was suddenly no longer able to connect to the Internet. It was still able to access all ...
2
votes
3answers
359 views

Do we need both Eset and SuperAntiSpyware?

Our company had a bad virus experience several years ago. Probably as a result, every pc has Eset Nod & SuperAntiSpyware installed. I think this is excessive and that Eset should allow sufficient ...
7
votes
3answers
2k views

Can a virus spread through a network share used by an RDP connection?

When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote ...
10
votes
3answers
854 views

Postfix sending and receiving the same e-mail every 5 minutes for 4+ months

Back in June I sent myself the EICAR test signature to make sure my postfix/amavis/spamassassin etc setup was working properly. I didn't notice at the time, but this somehow created a tear in the ...
1
vote
1answer
254 views

How do you make Apache vulnerable to Slowloris? [closed]

I'm trying to set up an apache server that's distinctly vulnerable to the slowloris denial of service so I can test the results, the only problem is that I can't seem to get slowloris to actually work ...
-1
votes
1answer
40 views

How can I uninstall Antivirus Studio 2010 completely? [closed]

Is Antivirus Studio 2010 malware? I found it installed on my computer yesterday, and I try to uninstall it with Control Panel. But I noticed that it is still running! How can I uninstall it ...
1
vote
2answers
190 views

Amazon EC2 Morto worm and Windows RDP

We run an Amazon EC2 Windows instance and recently received an email from Amazon warning us that RDP is open to everybody and there is a new threat in the wild that may exploit this. The security ...
0
votes
2answers
130 views

Trojan of Web-server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In our web-server most of the sites are infected with this JS-Downloader Trojan. It injected the following code. I've tried to ...
-2
votes
2answers
147 views

Good malware removal tool(s) for windows XP/Vista/7? [closed]

The goal for this Wiki is to extablish a list of known good tools for cleaning up those pesky malware / virues that haunt windows clients. What tools do you like and what are their strengths and ...
4
votes
2answers
538 views

Possible malware on my server, how to search the source?

Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears. The message is something like "The remote address has ...
3
votes
1answer
2k views

Cisco reputation filters mis-identified site as malware or “misconfigured DNS”

A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
2
votes
1answer
7k views

Detecting Torpig on a LAN

I am responsible for the oversight of the LAN at a college campus. Recently we started getting blacklisted by CBL because someone on our LAN is infected with Torpig (AKA Anserin). The suggestion ...
0
votes
1answer
115 views

Security & Malware Protection for Windows 2008 Server (with RDP)

I am running an ASP.NET site on a windows 2008 server with RDP access to the server. Installing or enabling firewalls shuts off my RDP access and multiple other issues. My hosting provider is very ...
1
vote
1answer
335 views

Restrict number of parallel connections on Apache server

I'm on an Ubuntu server running Apache2. I would like to protect myself against (d)dos and syn flood attacks and therefore try to limit the number of parallel connections per client IP. I've heard ...
1
vote
1answer
319 views

How can I limit Googlebot's crawl rate?

I have a problem with one of my servers. Google opens lots of http connections to the apache server and basically performs a slowloris attack. This netstat call results in the following output ...
0
votes
2answers
921 views

Strange email coming from/to my computer

I'm running smtp4dev on my machine to trap anything going in/out of my computer on port 25 for testing purposes. Every so often this email gets trapped and I have no idea what it's from. I have ...
2
votes
2answers
1k views

Symantec Endpoint Protection Virus Definitions

I have done some Googling but I cannot get a definitive answer certainly not from the Symantec KB. I have a Virtualised Win 2003R2 server 32bit. It has been provisioned to me with Symantec Endpoint ...
0
votes
2answers
84 views

Host File Redirect From Virus

I have a clients laptop that is doing the redirect of web pages to other sites. I have run HitManPro and Combofix and they didn't come up with anything major. There is no proxy set in Internet ...
7
votes
2answers
2k views

Why are NginX and Lighttpd not affected by Slowloris?

I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works. What I don't understand is why Lighttpd and NginX are not affected (according to the ...
0
votes
3answers
107 views

Dedicated Server hit with viruses

Since setting up my dedicated server I have been hit with many viruses. 1 would eat up my bandwidth and another is currently sending out trojans to any outgoing mail from my mail server. Is there a ...
1
vote
0answers
301 views

Scan a NAS Device with Microsoft Forefront Endpoint Protection

We are having problems with viruses sneaking through our virus scanner and onto our NAS and I want to scan the whole NAS. If I attempt to run a scan on the whole drive using the GUI for Forefront ...
0
votes
1answer
171 views

windows xp home security Trojan.FakeAlert - virus/scareware/malware

We have just had our second outbreak of a variant of the Windows XP home security malware (malwarebytes called it Trojan.fakeAlert). It manages to kill our antivirus (nod 32), and then kill attempts ...
0
votes
3answers
93 views

Problem for my website, Some attack pages intentionally distribute harmful software [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Some pages of my website are distributing harmful software. How do I investigate and fix this?
1
vote
2answers
278 views

addthis_widget detected as virus

We use sunbelts VIPRE enterprise systems, and I was alerted to almost every computer in the company having this and being quarantined. Is anyone familiar with addthis_widget.js. It detects it as a ...
0
votes
4answers
591 views

Portable Malware Scanning Software for Win2008

Is there any malware/spyware/virus scanning software that can be run via USB or other means to scan a windows server 2008? It needs to be something that does not need to be installed.
6
votes
5answers
300 views

Kids + older computers + our network at the office: Security risk?

On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
2
votes
3answers
2k views

Debian webserver malware scanner

I was wondering if there was a malware scanner for websites with up to date exploits for use on a Debian webs server with Apache2.2? Vulnerability scanners are great, but I also want to be sure that ...
-1
votes
2answers
136 views

cann anyone solve this questino? [closed]

Routers on the internet never forward packets coming from private IP addresses Explain. Can you see any advantage in this?
1
vote
1answer
49 views

Administering forums on servers, seeing weird attacks

I'm not sure ServerFault is the correct place for such a question: please redirect if another StackExchange site is more appropriate but I think this is the "most correct" one. On one of the server ...
0
votes
1answer
113 views

Server redirect malware [duplicate]

I have a linux packaged server (is that right?) that I run for a coworker. It has recently been hacked and I've been trying for the last few days to get rid of the malware. It now redirects most of my ...
0
votes
1answer
694 views

How Can I Disable \PIPE\svcctl in Group Policy?

This is more of a networking question than a programming question. There is a virus running amok on our network at work and it seems to be taking down our servers. I have determined that the virus ...
25
votes
2answers
4k views

Unusual HEAD requests to nonsense URLs from Chrome

I have noticed unusual traffic coming from my workstation the last couple of days. I am seeing HEAD requests sent to random character URLs, usually three or four within a second, and they appear to be ...
2
votes
4answers
663 views

Virus blocking incoming connections?

On my Windows Server 2003 server, all incoming connections are dropped. I can see them getting in using Wireshark, but even a single ping from another computer fails. All locally initiated connection ...
2
votes
3answers
668 views

Force Apache2.2 to drop a request

Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a ...
2
votes
3answers
331 views

What would you do when a worm infects everything?

Ive always wondered, what can we do if a virus or worm happens to affect the main file server? What if from the file server the clients get infected by said worm/virus? How would you clean it up? ...
0
votes
1answer
335 views

Possible causes for Domain server being unavailable? [duplicate]

Possible Duplicate: Reinstall after a Root Compromise? One of our servers was compromised after a user with administrative privileges accidentally loaded a virus from a USB drive on a ...
0
votes
3answers
148 views

What options do I have for virus protection on windows server 2008 (this server is not a mail server)?

I would like to use some kind of virus protection on the server. What options do I have? I installed MS security essentials, but I just learned that I is not for commercial/government use.
0
votes
3answers
230 views

DirectAdmin Centos4 server has virus

I have a problem with a webserver that runs Centos4 with DirectAdmin. Since a few weeks some websites hosted on it are not redirecting on search engines properly, they are redirected to some malware ...
0
votes
1answer
707 views

vi.recover/update command appears every minute in cron log. (POSSIBLE VIRUS)

UPDATE (7th Dec 2010) & WARNING: I copied the files discussed below (from the /var/tmp/vi.recover directory) to my Windows PC and sacnned with ESET NOD 32. It identifed two of the file (sshd: and ...
0
votes
2answers
391 views

Removing VirTool:Win32/VBInject.gen!DG

i get this little bugger poping up every start up, my microsoft security essentials stops initial attempt and there no threat till next start up. I was wondering, if there any tools to check and ...
1
vote
1answer
95 views

Looking to build a lab to help students to combat the Sasser Virus? Does anyone know where I can get a copy of the virus? [closed]

Looking to build a lab to help students to combat the Sasser Virus? Does anyone know where I can get a copy of the virus?
1
vote
2answers
156 views

Search result redirect virus

I'm stumped. I'm up against a virus on a desktop PC that has hijcaked all search results (Google, Yahoo!, Bing, etc.) in both IE and Firefox, and it happens to both accounts that log into the ...
1
vote
5answers
979 views

I believe I have a virus in my server!

For the past few weeks I have been noticing the code in my index.htmls on my host, changing by it self. The other day Chrome and Firefox have started to list the sites hosted on my server as attack ...
2
votes
3answers
619 views

how i can write test virus?

i have a website and in website some people can upload files .... and when user upload file it must scan from virus by antivirus ... so i need test virus have the following extention (.doc ,jpg, png, ...
0
votes
5answers
117 views

Can anyone think of a way of preventing an XP client from performing DNS lookups for external domains?

As usual, we're trying to tighten security even further in our organisation. The current focus for me is the possibility of a compromised XP client from using DNS lookups as a command/control channel ...
0
votes
1answer
59 views

What is the expamapi.dll in windows folder?

I'm getting a virus message related to expamapi.dll in c:\Windows (windows xp). When I used ProcessExplorer, this dll is related to a bunch of processes, which isn't making sense. Some of the ...