Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

-1
votes
0answers
9 views

My site is blocked by Avast as URL:Mal

My site https://www.ziply.ru is blocked by Avast as URL:Mal I have fully checked my server and didn't found any viruses\malwares. And by checking here - ...
0
votes
0answers
19 views

Receiving empty mails from three different Windows PC's since 12th January 2015

Since 12th Jan 2015 I am getting strange empty mails to my inbox every day. I was not able to trace their source. Fact I've noticed so far: they are all from company where I do network/sys support ...
0
votes
1answer
31 views

How to remove crypto-ransomware on my network domain

Today some computer on my domain got infected with crypto-ransomware and have infected some folders on file server that only some computers on network have access to. So I presume one or more of five ...
0
votes
0answers
22 views

Server making outbound dns requests [duplicate]

I have a cloud server with Rackspace and they have blocked DNS because of "excessive queries". I can find the info below when running ps, but I can not seem to locate where the file is that is making ...
0
votes
1answer
34 views

Tools for scanning database for viruses [closed]

I wonder if anyone knows some useful tool for scanning threats like sqlinjection, command injection in mysql databases? The db is for multiple wordpress, drupal installations. The first step obviously ...
4
votes
1answer
189 views

Server side antivirus or not?

We have basic server-side virus scanning in our datacenter, but it's expensive, uses a considerable amount of CPU cycles, and is annoying to maintain. I'm not looking for a sales-pitch on "better" AV ...
0
votes
2answers
1k views

High CPU load on Centos with process sync_supers

My centos server has high cpu load right now. Please see the Htop output below. sync_supers is very suspected but I don't know how to kill it. Any suggestions?
-1
votes
0answers
13 views

Linux: hacked account attempting ftp connections — how to identify and stop? [duplicate]

I transferred a (unknowingly) compromised Wordpress installation to my Ubuntu Server (14.04) and although I think I've managed to clean out most of the malware the account still periodically attempts ...
0
votes
0answers
23 views

Suspicious process running in background in Fedora [duplicate]

There is a suspicious process which every time I boot Fedora starts and eats a percentage of CPU (10%~30%) and I think its name seriously denotes that it is malware! However, the name keeps changing ...
-1
votes
0answers
36 views

Constant virus detections [duplicate]

My antivirus has been detecting quite a few viruses/trojans lately. Mainly Backdoor:PHP/Shell.P Backdoor:PHP/WebShell.J I have been trying to identify the source of these files with no luck so ...
1
vote
2answers
33 views

Why is this server generating outbound IRC connections? [duplicate]

I noticed last night whilst checking our active sessions list on our firewall for something else, that a server was generating outbound IRC connections. Last night there was around 60 connections but ...
0
votes
2answers
132 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
1
vote
1answer
49 views

Administering forums on servers, seeing weird attacks

I'm not sure ServerFault is the correct place for such a question: please redirect if another StackExchange site is more appropriate but I think this is the "most correct" one. On one of the server ...
0
votes
1answer
58 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
7
votes
3answers
2k views

Can a virus spread through a network share used by an RDP connection?

When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote ...
0
votes
0answers
15 views

Virus sends mails via sendmail [duplicate]

I noticed that my server has some bad software that sends mails via sendmail which couses a very slow working. I scaned server with clamscan but without effect. Is there any way to find out which ...
3
votes
2answers
191 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
0
votes
0answers
33 views

Automatic installation of DbSecurityspt folder

We have an Amazon EC2 instance. The folder DbSecurityspt gets automatically installed in c:/ProgramFiles and the associated service also starts automatically. Removing them, installs them again the ...
0
votes
0answers
25 views

Suspicious process self with random name in Fedora 20 [duplicate]

When I run top I see a two processes run by root with all random letters(jycybezyxa and jycybezyxa): >Tasks: 246 total, 2 running, 236 sleeping, 0 stopped, 8 zombie >%Cpu(s): 15.3 us, ...
1
vote
4answers
138 views

Blocking Invalid HTTP Requests to PHP Application

For the first time in a number of years, I'm semi-responsible for helping out with the server administration of a PHP web application (served out using Apache). We're seeing a number of requests for ...
1
vote
3answers
1k views

Linux Stealth Process

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again... ...
0
votes
0answers
19 views

My Hosting Infected with CryptoPHP Script Hostgator [duplicate]

Before 10days Hostgator migrated server to Indian Servers , and they said it is highly secure, As for more than 10 days i am getting problems in My backend word press plugins, So last 10 days i was ...
-1
votes
1answer
86 views

Server is trying to send out spam [duplicate]

My email server is attempting to send out a great deal of spam. I'm using Postfix & Dovecot. I'm trying to diagnose the problem and figure out how this is being sent. My guess right now is that ...
-1
votes
1answer
51 views

Backdoor:PHP/Shell.P keeps regenerating.Caught by Antivirus. [duplicate]

I have a windows server 2008 with PHP on it and a few Wordpress sites on it. I got a virus some time ago. I thought I had it deleted and everything was fine but after looking at my Quarantine section ...
-5
votes
1answer
57 views

How to check if any malevolent scripts are running on the server? [closed]

I want to give some small jobs to freelancers who would have FTP access to my websites hosted on my server. I heard that sometimes it's possible they put malevolent scripts and software on the ...
1
vote
2answers
52 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
0
votes
1answer
103 views

Monitoring “external” worm activity remotely

Some of our computers in our company has been infected with the worm Conficker. We don't know the source of the infection, but I want to monitoring the outside activity to see if we are still infected ...
0
votes
1answer
85 views

Good resource for evaluting AV and anti Malware software?

I am looking for good resources to use to compare the effectiveness of various antivirus/antimalware software solutions. In particular, I am comparing Windows Security Essentials against Symantec ...
0
votes
1answer
707 views

vi.recover/update command appears every minute in cron log. (POSSIBLE VIRUS)

UPDATE (7th Dec 2010) & WARNING: I copied the files discussed below (from the /var/tmp/vi.recover directory) to my Windows PC and sacnned with ESET NOD 32. It identifed two of the file (sshd: and ...
0
votes
2answers
113 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...
0
votes
1answer
331 views

False positive rate of CBL

We've come into the office (30+ networked systems) this morning to find that our email server is blacklisted on the CBL for: This IP address is infected with, or is NATting for a machine infected ...
-1
votes
1answer
454 views

Getting rid of Trojan on Debian Server [duplicate]

-------- EDIT --------- I do not agree that this is a duplicate of the linked question. I know that the correct way to deal with this is to wipe and reinstall the server. However, i am interested in ...
-1
votes
1answer
194 views

My website redirects to malware link [duplicate]

I coded my own website and uploaded to a host. Some days ago I realized that in front page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects ends up at: ...
0
votes
1answer
69 views

How to add wildcards to Linux Malware Detect ignore_paths

I am using Linux Malware Detect to scan and report on malware, but on a daily basis I receive alerts for malware in users emails (mainly spam folder). I do not want alerts for this, the spam folders ...
10
votes
7answers
2k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
0
votes
1answer
134 views

sed comand - remove virus from wordpress [duplicate]

I have malicious code in every php file. This malicius code is auto paste at the beginning of file. I want to remove this with UNIX command from console. This is malicious code: <?php ...
0
votes
0answers
106 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
1
vote
2answers
71 views

Unknown issue taking down client machines, virus or coincidence

I’m sorry if this should be on SuperUser instead of ServerFault. Please ask me to migrate the question instead of flaming. I’ve had 2 windows desktops go down on the network in the space of one ...
0
votes
0answers
44 views

Maldetect Ignore List Not Being Honoured

I'm using Maldetect on CentOS to scan for malware on my server. I have hundreds of thousands of audio files on my server which I do not want scanned. According to the README: ...
1
vote
1answer
41 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
1answer
61 views

Host says server is affected by malware, anyone knows this one ? What to do? [duplicate]

My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS. Anyone ...
0
votes
2answers
133 views

Is this slowloris attack or not?

IP is hidden in apache log for privacy, except last octet. /billing is our application start page. But it doesn't make sense that it sends POST requests, and get 500 response. Or maybe this is ...
2
votes
0answers
285 views

Slowloris on Apache: is mod_reqtimeout + mod_qos enough?

I detected few days ago that my server was under slowloris attack (I found a lot of "-" 408 0 "-" "-" values in my access.log). I changed my configuration like this: In mod_reqtimeout: ...
1
vote
1answer
89 views

malware infected server respawing of files [duplicate]

So I have a clients server that is infected with malware. Basically any index.php file on the server was infected as well as header.php, function.php. The infection seems to be primarily wordpress ...
0
votes
1answer
107 views

What are best practices for defense against CryptoLocker type threats in an Active Directory environment?

What are best practices for defense against CryptoLocker type threats in an Active Directory environment? Are there Group Policies that could help? NTFS permissions? Anti-virus software?
0
votes
1answer
113 views

Server redirect malware [duplicate]

I have a linux packaged server (is that right?) that I run for a coworker. It has recently been hacked and I've been trying for the last few days to get rid of the malware. It now redirects most of my ...
0
votes
1answer
52 views

How to view traffic operating on a specific port without plugging into egress interface? (Cisco IOS)

I'm trying to track down what host is infected with ZeroAccess on my network. It runs on ports 16464-16471. I would like to find this host without having to connect my laptop to the egress (WAN) ...
2
votes
2answers
1k views

Symantec Endpoint Protection Virus Definitions

I have done some Googling but I cannot get a definitive answer certainly not from the Symantec KB. I have a Virtualised Win 2003R2 server 32bit. It has been provisioned to me with Symantec Endpoint ...
0
votes
0answers
135 views

Is Jetty immune to Slow HTTP Denial of Service attacks (e.g., slowloris)?

After a security scan, our webserver was found to be vulnerable to "slow HTTP denial of service" attacks. We are currently on an older version of Jetty (6.1.22). I'm not sure if the scan actually ...
1
vote
2answers
716 views

How to find any file that is an executable or library

Let's say someone provides you with a tarball, saying it is source code and nothing else. You want to make sure that is true, and that no virus-laden executables or libraries are tucked away in a ...