Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
1answer
762 views

identity and rectify port scanning activities on CentOS [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux (CentOS 5.x) machine seem to have been attacked. Port scanning activities were traced to it. However, the ports (to be) ...
1
vote
2answers
52 views

Program to log when files are written to a folder

One of our companies server seems to have fallen victim to a php backdoor attack. I've managed to located and close several holes, but one seems to persist that is writing a php/webshell backdoor ...
1
vote
3answers
1k views

Scan whole system or just user dirs with clamav

I'm in doubt about how to scan my Linux system with Clamav: do I just scan the places where users can upload files (homedirs, their webroots) or do I scan the whole system? The various sites I've ...
1
vote
2answers
240 views

One machine blocked from a single server, and only when it's at this physical location?

I host an e-commerce website for a client who suddenly is unable to access it from his computer. He can ping the server, he can SSH in, but cannot load the website in any browser we've tried: IE, ...
0
votes
2answers
91 views

strange tcp network connections 149.9.1.16:ircd [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I am seeing strange tcp connection 149.9.1.16:ircd ans it is running perl service and that process is creating huge load on server ...
0
votes
1answer
86 views

Good resource for evaluting AV and anti Malware software?

I am looking for good resources to use to compare the effectiveness of various antivirus/antimalware software solutions. In particular, I am comparing Windows Security Essentials against Symantec ...
-1
votes
1answer
253 views

.htaccess malware detected - where to report? [closed]

just detected some .htaccess malware on one of my servers (shared hosting). The provider (1and1) doesn't seem to care (we take a look into this on monday). Is there any good place to report this ...
0
votes
1answer
580 views

Critical Virus infection with PHP website. What are the options to remove Virus? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have a critical virus infection to one of my website. There is a additional script found added at footer of few web pages . the ...
0
votes
2answers
894 views

How to remove .htaccess virus [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Subdomain folder with root folder they write a .htaccess file with this code <IfModule mod_rewrite.c> ...
1
vote
3answers
1k views

Linux Stealth Process

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again... ...
12
votes
4answers
1k views

How do I deal with the removal/eradication of an unknown worm on our network?

TL;DR I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
1
vote
4answers
117 views

sendmail sending mail to recipients I don’t know of; possible spam host

Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday. STATISTICS ---------- Messages To Recipients: 582 Addressed Recipients: ...
1
vote
0answers
92 views

SBS client can suddenly not access Internet, had Kryptik trojan

I have a question regarding Windows Small Business Server 2011. Yesterday, one of the computers in our domain was suddenly no longer able to connect to the Internet. It was still able to access all ...
2
votes
3answers
368 views

Do we need both Eset and SuperAntiSpyware?

Our company had a bad virus experience several years ago. Probably as a result, every pc has Eset Nod & SuperAntiSpyware installed. I think this is excessive and that Eset should allow sufficient ...
7
votes
3answers
2k views

Can a virus spread through a network share used by an RDP connection?

When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote ...
10
votes
3answers
881 views

Postfix sending and receiving the same e-mail every 5 minutes for 4+ months

Back in June I sent myself the EICAR test signature to make sure my postfix/amavis/spamassassin etc setup was working properly. I didn't notice at the time, but this somehow created a tear in the ...
1
vote
1answer
259 views

How do you make Apache vulnerable to Slowloris? [closed]

I'm trying to set up an apache server that's distinctly vulnerable to the slowloris denial of service so I can test the results, the only problem is that I can't seem to get slowloris to actually work ...
-1
votes
1answer
40 views

How can I uninstall Antivirus Studio 2010 completely? [closed]

Is Antivirus Studio 2010 malware? I found it installed on my computer yesterday, and I try to uninstall it with Control Panel. But I noticed that it is still running! How can I uninstall it ...
1
vote
2answers
192 views

Amazon EC2 Morto worm and Windows RDP

We run an Amazon EC2 Windows instance and recently received an email from Amazon warning us that RDP is open to everybody and there is a new threat in the wild that may exploit this. The security ...
0
votes
2answers
131 views

Trojan of Web-server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In our web-server most of the sites are infected with this JS-Downloader Trojan. It injected the following code. I've tried to ...
-2
votes
2answers
149 views

Good malware removal tool(s) for windows XP/Vista/7? [closed]

The goal for this Wiki is to extablish a list of known good tools for cleaning up those pesky malware / virues that haunt windows clients. What tools do you like and what are their strengths and ...
4
votes
2answers
544 views

Possible malware on my server, how to search the source?

Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears. The message is something like "The remote address has ...
3
votes
1answer
3k views

Cisco reputation filters mis-identified site as malware or “misconfigured DNS”

A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
2
votes
1answer
7k views

Detecting Torpig on a LAN

I am responsible for the oversight of the LAN at a college campus. Recently we started getting blacklisted by CBL because someone on our LAN is infected with Torpig (AKA Anserin). The suggestion ...
0
votes
1answer
117 views

Security & Malware Protection for Windows 2008 Server (with RDP)

I am running an ASP.NET site on a windows 2008 server with RDP access to the server. Installing or enabling firewalls shuts off my RDP access and multiple other issues. My hosting provider is very ...
1
vote
1answer
350 views

Restrict number of parallel connections on Apache server

I'm on an Ubuntu server running Apache2. I would like to protect myself against (d)dos and syn flood attacks and therefore try to limit the number of parallel connections per client IP. I've heard ...
1
vote
1answer
326 views

How can I limit Googlebot's crawl rate?

I have a problem with one of my servers. Google opens lots of http connections to the apache server and basically performs a slowloris attack. This netstat call results in the following output ...
0
votes
2answers
963 views

Strange email coming from/to my computer

I'm running smtp4dev on my machine to trap anything going in/out of my computer on port 25 for testing purposes. Every so often this email gets trapped and I have no idea what it's from. I have ...
2
votes
2answers
1k views

Symantec Endpoint Protection Virus Definitions

I have done some Googling but I cannot get a definitive answer certainly not from the Symantec KB. I have a Virtualised Win 2003R2 server 32bit. It has been provisioned to me with Symantec Endpoint ...
0
votes
2answers
85 views

Host File Redirect From Virus

I have a clients laptop that is doing the redirect of web pages to other sites. I have run HitManPro and Combofix and they didn't come up with anything major. There is no proxy set in Internet ...
8
votes
2answers
3k views

Why are NginX and Lighttpd not affected by Slowloris?

I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works. What I don't understand is why Lighttpd and NginX are not affected (according to the ...
0
votes
3answers
107 views

Dedicated Server hit with viruses

Since setting up my dedicated server I have been hit with many viruses. 1 would eat up my bandwidth and another is currently sending out trojans to any outgoing mail from my mail server. Is there a ...
1
vote
0answers
317 views

Scan a NAS Device with Microsoft Forefront Endpoint Protection

We are having problems with viruses sneaking through our virus scanner and onto our NAS and I want to scan the whole NAS. If I attempt to run a scan on the whole drive using the GUI for Forefront ...
0
votes
1answer
171 views

windows xp home security Trojan.FakeAlert - virus/scareware/malware

We have just had our second outbreak of a variant of the Windows XP home security malware (malwarebytes called it Trojan.fakeAlert). It manages to kill our antivirus (nod 32), and then kill attempts ...
0
votes
3answers
93 views

Problem for my website, Some attack pages intentionally distribute harmful software [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Some pages of my website are distributing harmful software. How do I investigate and fix this?
1
vote
2answers
288 views

addthis_widget detected as virus

We use sunbelts VIPRE enterprise systems, and I was alerted to almost every computer in the company having this and being quarantined. Is anyone familiar with addthis_widget.js. It detects it as a ...
0
votes
4answers
637 views

Portable Malware Scanning Software for Win2008

Is there any malware/spyware/virus scanning software that can be run via USB or other means to scan a windows server 2008? It needs to be something that does not need to be installed.
6
votes
5answers
301 views

Kids + older computers + our network at the office: Security risk?

On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
2
votes
3answers
2k views

Debian webserver malware scanner

I was wondering if there was a malware scanner for websites with up to date exploits for use on a Debian webs server with Apache2.2? Vulnerability scanners are great, but I also want to be sure that ...
-1
votes
2answers
136 views

cann anyone solve this questino? [closed]

Routers on the internet never forward packets coming from private IP addresses Explain. Can you see any advantage in this?
1
vote
1answer
49 views

Administering forums on servers, seeing weird attacks

I'm not sure ServerFault is the correct place for such a question: please redirect if another StackExchange site is more appropriate but I think this is the "most correct" one. On one of the server ...
0
votes
1answer
114 views

Server redirect malware [duplicate]

I have a linux packaged server (is that right?) that I run for a coworker. It has recently been hacked and I've been trying for the last few days to get rid of the malware. It now redirects most of my ...
0
votes
1answer
717 views

How Can I Disable \PIPE\svcctl in Group Policy?

This is more of a networking question than a programming question. There is a virus running amok on our network at work and it seems to be taking down our servers. I have determined that the virus ...
25
votes
2answers
4k views

Unusual HEAD requests to nonsense URLs from Chrome

I have noticed unusual traffic coming from my workstation the last couple of days. I am seeing HEAD requests sent to random character URLs, usually three or four within a second, and they appear to be ...
2
votes
4answers
702 views

Virus blocking incoming connections?

On my Windows Server 2003 server, all incoming connections are dropped. I can see them getting in using Wireshark, but even a single ping from another computer fails. All locally initiated connection ...
2
votes
3answers
693 views

Force Apache2.2 to drop a request

Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a ...
2
votes
3answers
332 views

What would you do when a worm infects everything?

Ive always wondered, what can we do if a virus or worm happens to affect the main file server? What if from the file server the clients get infected by said worm/virus? How would you clean it up? ...
0
votes
1answer
336 views

Possible causes for Domain server being unavailable? [duplicate]

Possible Duplicate: Reinstall after a Root Compromise? One of our servers was compromised after a user with administrative privileges accidentally loaded a virus from a USB drive on a ...
0
votes
3answers
151 views

What options do I have for virus protection on windows server 2008 (this server is not a mail server)?

I would like to use some kind of virus protection on the server. What options do I have? I installed MS security essentials, but I just learned that I is not for commercial/government use.
0
votes
3answers
236 views

DirectAdmin Centos4 server has virus [duplicate]

I have a problem with a webserver that runs Centos4 with DirectAdmin. Since a few weeks some websites hosted on it are not redirecting on search engines properly, they are redirected to some malware ...