Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

2
votes
5answers
9k views

Virus sending phishing emails through exchange server

It appears that there is a virus on my network somewhere that is sending phishing emails through my exchange server. I can see the messages in message tracking and I see many SMTP errors for NDR's and ...
0
votes
1answer
483 views

Wine and windows virus

Does installing wine pose a risk of virus infection? I'm afraid a powerful virus can bypass wine sandbox and gain access to root linux. Thank you.
0
votes
1answer
667 views

fast way to find network user computer on domain hogging all wan bandwidth

i have a network of about 40 domain users and i have huge latency wan issues, like 1400ms for google.com pings. I have noticed that the problem goes away after everyone goes home for the day. I would ...
5
votes
1answer
1k views

How to scan uploaded file for virus on linux?

Just like the title, is there any antivirus that i can run from command prompt on linux to make sure user uploaded files are virus free? Thank you!
1
vote
1answer
77 views

Files deleted. What could have happened?

I'm having a weird issue today. I was writing and testing out some simple cgi scripts this morning when I realized that I couldn't run them from one of the other computers on the (windows) network. So ...
0
votes
3answers
82 views

Missing NIC and USB devices

Coming into work today, I've found we have a few different computers (different companies/networks/OS versions - all windows based) that are all having the same issue. 1) Network NIC is not able to ...
2
votes
6answers
284 views

What's the common cause for trojan downloaders on linux servers?

On several of the webservers i'm responsible for there's a javascript virus, a trojan downloader according to the antivirus i'm using. It's a minified javascript that's on the bottom of every page ...
7
votes
3answers
5k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
4
votes
4answers
1k views

Should I upgrade to Symantec Endpoint Protection? [closed]

I'm the IT manager at an animal shelter in Upstate New York. We have a Windows network with about 50 desktops running Windows XP Pro. We used to use CA eTrust Antivirus, but that product didn't work ...
1
vote
1answer
311 views

DNSHost.exe trojan found, now after fix, no one can print

What started today as an inability to get to the internet (but people could get in just fine), morphed to we realized that the DNS Server wasn't working, then we figured out that we had a trojan ...
2
votes
3answers
256 views

Rebuild or repair? [duplicate]

Possible Duplicate: Updating Malware cleaning skills I was having an argument the other day regarding damaged systems. If a system has a hard to eradicate virus, etc, or has been damaged by a ...
8
votes
5answers
290 views

Securing Acrobat Reader to mitigate viruses

Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...
1
vote
2answers
117 views

What's your attitude towards malware-friendly hosting providers?

Last week I had to deal with the following situation: some of my users complained that they got emails telling them that their computers are infected and they should go to a certain site for a free ...
1
vote
5answers
5k views

Virus that duplicates word documents as exe

We are facing a virus problem on our network, but I'm unable to identify it, so we can't properly deal with it. The symptoms are that the virus duplicates a word document (.doc) generating a new ...
0
votes
2answers
53 views

Has anyone seen gvtlsysguard.exe in the wild?

has anyone seen this file before "gvtlsysguard.exe" and have any idea what it is? This weekend, I noticed one of my users had this file in their user profile's Local Settings folder and somehow they ...
2
votes
3answers
112 views

Suggestions requested on what to cover in seminar on `Recent Trends in Virus & Anti-virus Stratagies` [closed]

I'm going to give a seminar on "Recent Trends in Virus & Anti-virus Strategies" as a part of my course work in my Post Graduation. I got two months of time. So, I want to fully utilize this period....
0
votes
2answers
279 views

Heeeelp! False positives from ZoneAlarm Force Field on my website will scare users away

I recently helped create a website for a conference that I am helping to host. We mailed out about 30,000 brochures and are expecting the big wave of traffic to start in a day or two. However, we keep ...
1
vote
3answers
267 views

NAT or proxy against malicious software

I had this conversation with a colleague about preventing viruses/trojans from accessing the internet from within a corporate network. He says that a proxy server for http traffic with an unusual port ...
0
votes
2answers
542 views

Malicious Script on LAMP Server

We have recently noticed that a malicious script is inserting itself in a number of PHP and HTML files on our domain questoons.com and the various add-on domains hosted on this account. The script ...
2
votes
5answers
241 views

Do you maintain an OMG it's !@#$ed CD with Utilities to recover and clean computers? What is on it? [closed]

I'm getting ready to build one with some of the common apps I use including malwarebytes, Spybot, and memtest86 . What elese do you recommend I add? Is there a single CD image out there that has all ...
0
votes
2answers
1k views

Unable to browse internet after virus infection (AntiVirus Pro 2010)

Some users on our network were infected recently with the AntiVirus Pro 2010 virus. The users disabled the anti-virus to install an application that resulted in AntiVirus pro being installed on the ...
0
votes
1answer
48 views

Removing a control kit from the server

The server my site is on was infected using the (pardon my obfuscation) Y-E-S E-x-p-l-o-i-t S-y-s-t-e-m It is a "control kit". I found out some info about it from http://cassandrasecurity.com/?p=...
3
votes
2answers
221 views

My website is infected, I restored a backup of the uninfected files, how long will it take to un-mark as dangerous?

My website www.sagamountain.com was recently infected by a malware distributor (or at least I think it may have been). I have removed all external content, google ads, firefly chat, etc. I uploaded ...
9
votes
1answer
798 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
1
vote
5answers
417 views

Is my server being hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I got this weird page, which I am very sure was not created by me: <iframe src="http://a.bad.site:8080/ts/in.cgi?pepsi106" width=...
1
vote
1answer
39 views

malicious files

can virus's/spyware/malware/trojans/worms get on your remote desktop/terminal services servers from a local machine?
1
vote
2answers
781 views

Best practices for isolating malware/honeypot samples

I am pursuing malware research and am wondering what are the best practices for building safe VM's to contain the code while disassembling it. So far: Each instance for examining the code is housed ...
1
vote
1answer
859 views

Remove eml and HTML:Nimda viruses from my Linux machine

(yes, the title is strange, but read on...) I copied some data from here and there on my linux box and now i find some many eml and HTML:Nimda viruses on my system when i scan it using clamtk. ...
1
vote
3answers
161 views

Is it normal for port 23 to be connected to periodically?

While working at a customer site (a LAN that includes several Windows machines, plus our server) I noticed that something was periodically attempting to connect to our server on port 23 via TCP. ...
2
votes
5answers
1k views

What is the process of cleaning viruses from a network?

We have a problem with a network virus that spread through our network and most computers have been infected. What should I do to remove the virus? By installing and scanning anti-virus software, the ...
5
votes
8answers
3k views

How can I test if a website is infected with malware?

Some friends of mine have a website (www.kennelsoffie.dk) and I'm trying to help them when there is any trouble. However this time I, can't figure it out. When I visit the site using Google Chrome, I'...
6
votes
12answers
762 views

Hardening a financially critical Windows computer

One of the risks to small and medium businesses is losing your bank credentials to bad guys by use of a key logger or other malware as Bruce Schneier blogs about. A particular threat is real-time key ...
3
votes
2answers
12k views

Strange scheduled tasks on Windows Server 2003

A few days ago, I noticed that our Windows Server 2003 system has strange scheduled tasks. I do not know where they came from or who set them up. I deleted them and they came up again today. They have ...
0
votes
1answer
2k views

Resolving the “Windows cannot access the specified device path or file” error

A user is reporting they might have a virus, although it might be related to their reinstalling zone alarm. I don't physically have access to the computer though. They are running Windows XP. When ...
-1
votes
2answers
245 views

Symantec - Flagging every local HTML file on my computer as a virus

I just ran Symantec Anti-Virus and it's flagging literally every since HTML, PHP, ASP/ASPX file on my computer as a virus. That's nearly 600 files on my laptop. Can this be? How can a text file (...
1
vote
3answers
262 views

XP Pro SP3 unresponsive requires power down

New to serverfault, but searched google and the forums here and haven't found anything regarding my issue. I have two laptops in my network that are displaying similar issues. They are from different ...
2
votes
4answers
434 views

Website attacked with a hidden iframe (q5x.ru)

A website of mine has recently been infected with some sort of attack that involved injecting a hidden iframe, and it's source was from a site q5x.ru (do not link). A Google search didn't help me in ...
12
votes
13answers
5k views

Make browsing safe for porn surfers

At several places I've done some work at, I have a suspicion that some of the executives browse porn on their work computers. It appears this porn surfing has lead to virus infections on their ...
0
votes
3answers
157 views

Site harmed by malware -or is it a server problem?

I have a site which is got harmed by this "spywarepc.info" and showing "Your site has been attacked by a Malware" :( ... don't even know what is this ? so i have opened spywarepc.info in a ...
0
votes
2answers
409 views

How do you remove the “ffsearcher” trojan?

Does anyone have any experience in removing the ffsearcher trojan. One of our systems is infected. The virus scanner doesn't detect it, but our websense program is detecting all the internet ...
-1
votes
6answers
190 views

*nix live CD to recover Vista host? [closed]

A friend of mine got his Vista PC infected by a virus. Before I tell him to just reboot with the maker-provided recovery DVD and lose all his data, is there a recommended Linux/*BSD live CD that he ...
10
votes
4answers
733 views

Updating Malware cleaning skills

I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
10
votes
5answers
2k views

Prevent execution of Windows executables

Is there any way to tell Windows (XP and above) not to execute files (*.exe files), which are present in drives/folders other than certain folders, that I mention? In short I want executables from ...
1
vote
7answers
2k views

I am starting to think that Prevx.com isnt a legit site…but heres my long-winded question

I apologize in advance for the long-winded post. I posted it all because I believe its informative and may be useful. Also, I posted my question at the end. Moments ago I was RDC to a file server ...
3
votes
10answers
1k views

google result redirect virus

I'm not so sure if this is the appropriate place for this, however I accidentally clicked this link which opened a video and infected my windows 2003 std server with this virus which not only creates ...
1
vote
11answers
267 views

Bad results from malware cleanup tools?

As there's already a wiki regarding cleanup tools, are there any tools that have given you negative results (i.e. made the system worse)?
3
votes
1answer
288 views

Google Web History shows

Google Web History Trends is showing URLs such as the following for 4 out of 10 of my Top Clicks (including the top 2): http://ocean2-4979731.org/page/0.volume http://ocean2-6610805.org/page/0....
7
votes
5answers
35k views

how to find out what created a file?

I have some virus files being randomly created on root of a c: disk of one of my servers. How can I find out what created it? Some 3rd party software maybe?
3
votes
2answers
1k views

How do I repair dhcp service after conficker infection on Windows 2003 Server?

How do I repair dhcp service after conficker infection on Windows 2003 Server? If the server is restarted with DHCP then it keeps attempting to acquire a network address. It seems to work fine if ...
4
votes
5answers
4k views

Best Open Source or Freeware Malware/Spyware/Antivirus with centralized management? [closed]

What are the best Malware/Spyware/Antivirus solutions? Several requirements for the solution: Open Source or Freeware Centralized Management Reporting and Remote Installation Think spybot / ...