Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

0
votes
0answers
25 views

Can't login to my machine with my account on Windows 7? [closed]

Since I started working here my Windows 7 64-bit computer has never had the correct GP applied to it, and as a result my computer didn't have it's folders redirected to the server. Many other system ...
0
votes
1answer
196 views

High CPU load on Centos with process sync_supers

My centos server has high cpu load right now. Please see the Htop output below. sync_supers is very suspected but I don't know how to kill it. Any suggestions?
1
vote
2answers
44 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
0
votes
1answer
85 views

Good resource for evaluting AV and anti Malware software?

I am looking for good resources to use to compare the effectiveness of various antivirus/antimalware software solutions. In particular, I am comparing Windows Security Essentials against Symantec ...
-1
votes
1answer
415 views

Getting rid of Trojan on Debian Server [duplicate]

-------- EDIT --------- I do not agree that this is a duplicate of the linked question. I know that the correct way to deal with this is to wipe and reinstall the server. However, i am interested in ...
-1
votes
1answer
130 views

My website redirects to malware link [duplicate]

I coded my own website and uploaded to a host. Some days ago I realized that in front page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects ends up at: ...
0
votes
1answer
46 views

How to add wildcards to Linux Malware Detect ignore_paths

I am using Linux Malware Detect to scan and report on malware, but on a daily basis I receive alerts for malware in users emails (mainly spam folder). I do not want alerts for this, the spam folders ...
10
votes
7answers
1k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
0
votes
0answers
29 views

Maldetect Ignore List Not Being Honoured

I'm using Maldetect on CentOS to scan for malware on my server. I have hundreds of thousands of audio files on my server which I do not want scanned. According to the README: ...
1
vote
1answer
37 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
1answer
52 views

Host says server is affected by malware, anyone knows this one ? What to do? [duplicate]

My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS. Anyone ...
0
votes
1answer
67 views

malware infected server respawing of files [duplicate]

So I have a clients server that is infected with malware. Basically any index.php file on the server was infected as well as header.php, function.php. The infection seems to be primarily wordpress ...
0
votes
1answer
83 views

What are best practices for defense against CryptoLocker type threats in an Active Directory environment?

What are best practices for defense against CryptoLocker type threats in an Active Directory environment? Are there Group Policies that could help? NTFS permissions? Anti-virus software?
0
votes
1answer
113 views

Server redirect malware [duplicate]

I have a linux packaged server (is that right?) that I run for a coworker. It has recently been hacked and I've been trying for the last few days to get rid of the malware. It now redirects most of my ...
0
votes
1answer
47 views

How to view traffic operating on a specific port without plugging into egress interface? (Cisco IOS)

I'm trying to track down what host is infected with ZeroAccess on my network. It runs on ports 16464-16471. I would like to find this host without having to connect my laptop to the egress (WAN) ...
0
votes
2answers
411 views

How do I remove 1 line of code from PHP files containing a specific string? [duplicate]

By coincidence I noticed that quite some of the PHP files of the sites I host have had malware injected: They all have the following line before the original/correct code: <?php ...
2
votes
1answer
160 views

WMI query of DNS shows a root hint that's not present in the DNS plugin.

I was writing a Powershell script for my network when I came across some alarming information in our DNS. Bear in mind we still use Powershell v2, not v3. So I have to query DNS via the Get-WMI ...
2
votes
1answer
161 views

Does anyone recognize this e-mail sniffer or malware using ROT13 encoding?

I have a private website that every week sends e-mails with two different http links to a group of around 30 people. When a link is clicked, the answer is registered in a database. Starting last week, ...
0
votes
1answer
714 views

group policy exception to disallowed

I'm trying to setup a group policy on a domain to block cryptolocker (among others). I'm mostly following the Cryptolocker Prevention Kit ...
0
votes
0answers
257 views

Suspicious “sys0972500-1.php”, I didn't put it on my server

Before 2 days I found inside the httpdocc a new folder which name was css. Inside this folder I found a file named sys0972500-1.php , which it caused send thousands spam emails from my server. I ...
0
votes
1answer
78 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
1
vote
0answers
33 views

Windows app not allowing debugging

I'll start by saying, I am not sure if this should go in StackOverflow or ServerFault. I posted it in StackOverflow earlier, but its been getting votes to close the question, so I assume it should be ...
0
votes
1answer
69 views

Locating malware on network

I am trying to isolate an email sending malware on my network. The headers are as follows: Received: from z.local.domain (172.18.248.22) by z.local.domain (172.18.248.22) with Microsoft SMTP Server ...
1
vote
2answers
178 views

Mac server infected with spam agent

We have a huge trouble :( .. Our mac server makes a spam delivery. Our IP already blacklisted in about a dozen of servers (checked with http://mxtoolbox.com/). We have another computers in the same ...
0
votes
1answer
228 views

Almost all of our websites within our server is redirecting to a porno scammy sites [duplicate]

We are having a problem within our server. After transferring the files to a new dedicated server, within only one or two weeks almost every website under our server is redirecting to a porno scammy ...
1
vote
1answer
2k views

Folders on our server2003-share are being “hidden”, replaced by .exe files

We have had following problem on our Windows2003 server for weeks now, every day the folder on our share are being made hidden and replaced by .exe files with the same names as the original folders. I ...
0
votes
0answers
42 views

BIND Configuration for malware analysis

we are working on a project to analyse the traffic generated by bots in a enterprise network isolated from internet. I would like to configure the BIND in this network to direct all otherwise ...
-1
votes
1answer
3k views

How to get rid of ebury malware / trojan on Centos / cpanel [duplicate]

I have a server with cPanel installed on Centos 5.9. Three days ago, my server provider told me I'm infected by "Ebury Trojan". I read a lot of things saying that the openSSH server coming with ...
-1
votes
1answer
57 views

Site blocked by google [closed]

I have my site that was hackered. I have removed all files and reloaded clean old files without the hacked code. Now when I use Google Chrome, I can't access my site because is shows as blocked. How ...
3
votes
2answers
821 views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
0
votes
3answers
68 views

watch file to see whos accessing/writing it and log it

I am facing some malware problems on my webserver. I updated third party software such as Wordpress to the latest version, disabled root logins and my users password complex enough but still someone ...
-3
votes
1answer
290 views

How to prevent non-power-users with admin rights from accidentally installing adware on community pc [closed]

I am going to describe my problem and solution to prevent non-power-users installing unwanted software along with other software (adware installed through pre-set checkboxes in a "desired software ...
1
vote
2answers
629 views

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of ...
0
votes
1answer
294 views

Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role

Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this: The message repeats every second and the port number is increased by one the range ...
0
votes
1answer
81 views

Malicious HTTP Post reuqest decoding

I have this request in my traffic, which is posting data to a malicious php file. T 212.193.229.17:60601 -> 9.9.9.9:80 [A] POST /images//sh.php HTTP/1.0. Host: dpfremovalwarrington.co.uk. ...
3
votes
1answer
2k views

Cisco reputation filters mis-identified site as malware or “misconfigured DNS”

A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
11
votes
4answers
1k views

How do I deal with the removal/eradication of an unknown worm on our network?

TL;DR I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
-1
votes
1answer
251 views

.htaccess malware detected - where to report? [closed]

just detected some .htaccess malware on one of my servers (shared hosting). The provider (1and1) doesn't seem to care (we take a look into this on monday). Is there any good place to report this ...
0
votes
1answer
102 views

Trying to hunt down malware on my server [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY A server of mine recently suffered a malware attack. I've since cleaned the server up a bit, upgraded a variety of wordpress installs ...
0
votes
0answers
76 views

Mass targeted malware installed - g00glestatic.com [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I run a webserver which over the last few days seems to have become infected with malware that tries to include content from ...
0
votes
1answer
75 views

Compromised web server/multiple domains [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY Earlier today I found a lot of weird files on one of my servers (running Ubuntu Server 10.04), which I can't understand how they got ...
1
vote
3answers
994 views

Scan whole system or just user dirs with clamav

I'm in doubt about how to scan my Linux system with Clamav: do I just scan the places where users can upload files (homedirs, their webroots) or do I scan the whole system? The various sites I've ...
-2
votes
1answer
297 views

Malware removal from the code [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY My web application has been hacked and trying to remove the malware/code injection. Scanning it through http://sitecheck.sucuri.net ...
1
vote
2answers
2k views

Got a malware on my hosting provider which infect JavaScript files .. how do I find the entry point?

This morning some sites which are hosted on the server as me started triggering malware alerts and started to redirect traffic to external sites. I've found out that a line of packed javascript was ...
2
votes
3answers
2k views

Debian webserver malware scanner

I was wondering if there was a malware scanner for websites with up to date exploits for use on a Debian webs server with Apache2.2? Vulnerability scanners are great, but I also want to be sure that ...
1
vote
1answer
193 views

String search and replace across an entire database

After an exploit on an ASP.NET site, the client was left with a specific string of malware code sprayed across the entire database, multiple columns of multiple tables. The prepended string is ...
4
votes
4answers
960 views

Should I upgrade to Symantec Endpoint Protection? [closed]

I'm the IT manager at an animal shelter in Upstate New York. We have a Windows network with about 50 desktops running Windows XP Pro. We used to use CA eTrust Antivirus, but that product didn't work ...
4
votes
5answers
3k views

Best Open Source or Freeware Malware/Spyware/Antivirus with centralized management? [closed]

What are the best Malware/Spyware/Antivirus solutions? Several requirements for the solution: Open Source or Freeware Centralized Management Reporting and Remote Installation Think spybot / ...
0
votes
1answer
1k views

Anti-Malware Antivirus for Linux Web Server? [closed]

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
1
vote
1answer
104 views

Hyper-V or VMware - Find all modifications/changes made between 2 Snapshots

I would like to use either Hyper-V or Vmware in order to find out after taking a Clean Base snapshot and a modified snapshot and what the modifications/differences and what was changed between the two ...