Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

2
votes
3answers
712 views

Force Apache2.2 to drop a request

Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a ...
2
votes
3answers
334 views

What would you do when a worm infects everything?

Ive always wondered, what can we do if a virus or worm happens to affect the main file server? What if from the file server the clients get infected by said worm/virus? How would you clean it up? ...
0
votes
1answer
339 views

Possible causes for Domain server being unavailable? [duplicate]

Possible Duplicate: Reinstall after a Root Compromise? One of our servers was compromised after a user with administrative privileges accidentally loaded a virus from a USB drive on a ...
0
votes
3answers
151 views

What options do I have for virus protection on windows server 2008 (this server is not a mail server)?

I would like to use some kind of virus protection on the server. What options do I have? I installed MS security essentials, but I just learned that I is not for commercial/government use.
0
votes
3answers
242 views

DirectAdmin Centos4 server has virus [duplicate]

I have a problem with a webserver that runs Centos4 with DirectAdmin. Since a few weeks some websites hosted on it are not redirecting on search engines properly, they are redirected to some malware ...
0
votes
1answer
742 views

vi.recover/update command appears every minute in cron log. (POSSIBLE VIRUS)

UPDATE (7th Dec 2010) & WARNING: I copied the files discussed below (from the /var/tmp/vi.recover directory) to my Windows PC and sacnned with ESET NOD 32. It identifed two of the file (sshd: and ...
0
votes
2answers
391 views

Removing VirTool:Win32/VBInject.gen!DG

i get this little bugger poping up every start up, my microsoft security essentials stops initial attempt and there no threat till next start up. I was wondering, if there any tools to check and ...
1
vote
1answer
96 views

Looking to build a lab to help students to combat the Sasser Virus? Does anyone know where I can get a copy of the virus? [closed]

Looking to build a lab to help students to combat the Sasser Virus? Does anyone know where I can get a copy of the virus?
1
vote
2answers
158 views

Search result redirect virus

I'm stumped. I'm up against a virus on a desktop PC that has hijcaked all search results (Google, Yahoo!, Bing, etc.) in both IE and Firefox, and it happens to both accounts that log into the ...
1
vote
5answers
1k views

I believe I have a virus in my server!

For the past few weeks I have been noticing the code in my index.htmls on my host, changing by it self. The other day Chrome and Firefox have started to list the sites hosted on my server as attack ...
2
votes
3answers
701 views

how i can write test virus?

i have a website and in website some people can upload files .... and when user upload file it must scan from virus by antivirus ... so i need test virus have the following extention (.doc ,jpg, png, ...
0
votes
5answers
119 views

Can anyone think of a way of preventing an XP client from performing DNS lookups for external domains?

As usual, we're trying to tighten security even further in our organisation. The current focus for me is the possibility of a compromised XP client from using DNS lookups as a command/control channel ...
0
votes
1answer
59 views

What is the expamapi.dll in windows folder?

I'm getting a virus message related to expamapi.dll in c:\Windows (windows xp). When I used ProcessExplorer, this dll is related to a bunch of processes, which isn't making sense. Some of the ...
0
votes
2answers
217 views

Windows 2003 Server monitoring tool for file writing

I am having a bit of a trojan problem. We have a Windows 2003 Server configured with a partition for file sharing for backup purposes. In our network there are about 50+ computers with access to these ...
3
votes
2answers
2k views

Privoxy rule to block Facebook spying

Recently, my server's Privoxy rules to block Facebook's spying have failed. How can I block current Facebook spying links? Since soon after the inception of Facebook's so-called “Open Graph” ...
0
votes
1answer
550 views

Ubuntu, Samba, Shared folders and unknown files

I am using ubuntu on my laptop with a EDGE connection. I have no computers on my LAN. First time this happened as a coincidence when i left a folder shared after office on my laptop and found it ...
1
vote
3answers
156 views

Need help controlling viruses

I've recently noticed an increase of viruses on my systems. We employ CA eTrust 8.1 for antivirus and all users are "Domain Users", and thus should not have access to install any software on their ...
1
vote
2answers
33 views

Need a resource to find out about latest attack activity?

Thought about this seeing another question pop up about a user agent string showing up in the poster's logs; is there a site for sysadmins to go to for finding the latest information about ...
0
votes
4answers
356 views

Website has links to Malware, Caused by virus

The computer that I do my most webdevelopment work with caught a virus. A website that I am currently working on was compromised(I think by phpDesigners stored FTP password). I currently get : ...
0
votes
4answers
1k views

Exchange 2007 server send out spam

Our exchange server is sending out spam, as it has been listed on various spam blacklist and not to sure know how to stop it. I've started with verify SMTP with a site like ...
0
votes
1answer
221 views

hiden iframe unescape

started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server: ...
1
vote
2answers
178 views

Infected Windows File Server, should we clean or wipe?

I'm troubleshooting a friend's Windows 2k3 file server (that I had setup for them a few weeks ago). It got infected by a tenga.gen virus and he's trying to clean it now but doesn't have a server ...
2
votes
5answers
738 views

Opinion question about security viruses and HTML attachments

In the last couple of weeks my company has been inundated by a group of viruses including an .html attachment. Some of these were subjected UPS shipment, some Western Union. All of them asking the ...
1
vote
5answers
239 views

how is it possible that a hacker could have inserted a piece of javascript code at the bottom of several of my pages

Somehow some javascript code got appended to the bottom of several of my index pages on my site. I know it's a trojan or iframe attack. However, I am wondering how is it even possible that someone ...
0
votes
1answer
247 views

Can i remove the virus from website scripts from unix shell [duplicate]

My website is infected with iframe injection and some javascript virus. There is some JS code which is present in all the files. Is there any way that i can paste that JS code in a text file and ...
0
votes
1answer
330 views

outgoing DNS flood targeted to non-ISP hosts

Below is the specific traffic monitored at the network perimeter and originating from a user PC on Vista platform. My question is not about the effects of the flood, but about the nature of the ...
2
votes
5answers
1k views

Google is blocking our requests due to “automated queries”; what's the best way to find out why?

This started a few weeks ago and we thought it was a virus so we checked every computer and all though 50%(Yeah, that's right) were infected once they were cleaned the problem didn't go away. It's ...
0
votes
2answers
618 views

JS Worm : how to find the entry point

my site is tagged as dangerous by Google / StopBadware.org, and I found this in severals js/html files : <script type="text/javascript" ...
2
votes
1answer
795 views

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
0
votes
3answers
194 views

Determine how the worm spread in the network [closed]

We had worm infestation problem in our network. I have cleaned all the worms and have taken appropiate steps. I wanted to how do you determine how the worm got spread in the network. Thanks, ...
1
vote
3answers
3k views

Ubuntu Server attack? how to solve?

Something (Someone) is sending out UDP packets sent from our whole ip range. This seems to be multicast DNS. Our server host provided this (Our IP Address is masked with XX): Jun 3 11:02:13 ...
0
votes
1answer
97 views

/manual/cache folder on my server?

On our site's server, once managed by someone who's no longer with us, there's a folder named "/manual/cache" which contains txt files named+like+this, mostly using pornographic-related keywords. The ...
2
votes
1answer
4k views

How to disable scheduled task services

As I am still fighting with Conficker infection on my Win Server 2003. I will like to temporarily disable scheduled task services on server. Until I can be sure that infection of network is over.
0
votes
4answers
143 views

Network Security Device/Software

We currently run Symantec Antivirus Corporate 10.2. The software is really easy to manage on a network but the actual virus detection isn't bad but the malware detection is crap. We recently were ...
1
vote
2answers
109 views

md5sum or sha1sum of legitmate microsoft system files

Is there a database or repository of the legitimate checksums for Microsoft system files? We think we have a 0day on DNS for Windows 2003 SP2 using IRC for command and control. (Latest McAfee does not ...
1
vote
3answers
113 views

What sites/publications are good for staying current on security and malware trends? [duplicate]

Possible Duplicate: Security Resources In my ever expanding quest for knowledge, I'm at the point where I feel like I need to be more up to date with the current security trends, as well as ...
0
votes
4answers
342 views

Malware vs Viruses

Is there a legitimate technical difference between malware and viruses? I have looked at the Wikipedia entries but I am not really seeing the difference. Currently, I kind of feel like this is just ...
0
votes
3answers
2k views

My website is infected with JS:ScriptIP-inf [Trj]

I am using Network Solutions hosting. I was recently attacked with JS:Illredir-S [Trj], I asked my hosting providers to clean it and they cleaned it and updated all passwords, but now after a week my ...
2
votes
5answers
7k views

Virus sending phishing emails through exchange server

It appears that there is a virus on my network somewhere that is sending phishing emails through my exchange server. I can see the messages in message tracking and I see many SMTP errors for NDR's and ...
0
votes
1answer
469 views

Wine and windows virus

Does installing wine pose a risk of virus infection? I'm afraid a powerful virus can bypass wine sandbox and gain access to root linux. Thank you.
0
votes
1answer
646 views

fast way to find network user computer on domain hogging all wan bandwidth

i have a network of about 40 domain users and i have huge latency wan issues, like 1400ms for google.com pings. I have noticed that the problem goes away after everyone goes home for the day. I would ...
5
votes
1answer
849 views

How to scan uploaded file for virus on linux?

Just like the title, is there any antivirus that i can run from command prompt on linux to make sure user uploaded files are virus free? Thank you!
1
vote
1answer
75 views

Files deleted. What could have happened?

I'm having a weird issue today. I was writing and testing out some simple cgi scripts this morning when I realized that I couldn't run them from one of the other computers on the (windows) network. So ...
0
votes
3answers
80 views

Missing NIC and USB devices

Coming into work today, I've found we have a few different computers (different companies/networks/OS versions - all windows based) that are all having the same issue. 1) Network NIC is not able to ...
2
votes
6answers
280 views

What's the common cause for trojan downloaders on linux servers?

On several of the webservers i'm responsible for there's a javascript virus, a trojan downloader according to the antivirus i'm using. It's a minified javascript that's on the bottom of every page ...
7
votes
3answers
5k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
4
votes
4answers
1k views

Should I upgrade to Symantec Endpoint Protection? [closed]

I'm the IT manager at an animal shelter in Upstate New York. We have a Windows network with about 50 desktops running Windows XP Pro. We used to use CA eTrust Antivirus, but that product didn't work ...
1
vote
1answer
301 views

DNSHost.exe trojan found, now after fix, no one can print

What started today as an inability to get to the internet (but people could get in just fine), morphed to we realized that the DNS Server wasn't working, then we figured out that we had a trojan ...
2
votes
3answers
256 views

Rebuild or repair? [duplicate]

Possible Duplicate: Updating Malware cleaning skills I was having an argument the other day regarding damaged systems. If a system has a hard to eradicate virus, etc, or has been damaged ...
8
votes
5answers
287 views

Securing Acrobat Reader to mitigate viruses

Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...