Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
2answers
42 views

Inspecting TLS/SSL passing in/out of a network without specialised device?

At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device. The motive is to ...
0
votes
2answers
38 views

Find out which PHP-Script starts Apache2-process

I would like to know how you find out which php-scripts are starting apache2-processes, which are causing high load. It seems that one user is infected with malware (php-shell). LMD (maldet/maldetect)...
0
votes
2answers
483 views

How can I check who created a file on server?

Looking through server logs I've noticed some mailicious PHP files hidden among WP and Joomla folders and I'm wondering how they got on the server. Is there a way to review that? It's a shared hosting ...
0
votes
2answers
394 views

Removing VirTool:Win32/VBInject.gen!DG

i get this little bugger poping up every start up, my microsoft security essentials stops initial attempt and there no threat till next start up. I was wondering, if there any tools to check and ...
-1
votes
2answers
246 views

Symantec - Flagging every local HTML file on my computer as a virus

I just ran Symantec Anti-Virus and it's flagging literally every since HTML, PHP, ASP/ASPX file on my computer as a virus. That's nearly 600 files on my laptop. Can this be? How can a text file (...
2
votes
1answer
129 views

Detecting/preventing malicious outlook rules

Attackers like to abuse Outlook for a variety of purposes. For example, an attacker could auto forward emails to a remote address or persist inside a network by creating client-side rules that ...
2
votes
1answer
389 views

WMI query of DNS shows a root hint that's not present in the DNS plugin.

I was writing a Powershell script for my network when I came across some alarming information in our DNS. Bear in mind we still use Powershell v2, not v3. So I have to query DNS via the Get-WMI ...
1
vote
1answer
53 views

We've had a ransom-ware attack - looking for help/advice

I've recently started working in a small subsidiary of a larger international organisation. My work is on the help desk, and there's 3 developers on the team, and our boss is the manager and acting ...
1
vote
1answer
1k views

Something renames files to filename.ext.suspected

I've experienced a very strange behavior on a Debian server. This server runs a lot of website, most of them CMS, mainly WordPress. And sometimes something renames my files from wp-db.php to wp-db....
1
vote
1answer
64 views

Malware scanning in the cloud (Azure)

Has anyone had success implementing a mechanism that can scan uploaded files for malware when using Azure? In this instance, I would be using their Sites and storage options, rather than controlling ...
1
vote
1answer
58 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
1
vote
1answer
609 views

Identifiying weird chinese registry entries in CurrentControlSet\Services

I noticed chinese characters inside my register under HKLM\System\CurrentControlSet\Services. Inside these there was nothing. I googled the strings and found nothing. Anyway for me to identify these? ...
0
votes
1answer
32 views

How can I identify applications or processes using thunder protocol in the network

For the last one week we have been having performance issues with our internet connection. The only thing that i know of that has changed with in this period is that I have upgraded several desktop OS ...
0
votes
1answer
415 views

How to remove crypto-ransomware on my network domain

Today some computer on my domain got infected with crypto-ransomware and have infected some folders on file server that only some computers on network have access to. So I presume one or more of five ...
0
votes
1answer
116 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
0
votes
1answer
92 views

Small business server 2011 standard - applications randomly closing for remote desktop users

Small business server 2011 standard - applications randomly closing for remote desktop users I have an issue where when you are connected through remote desktop (doesn't matter whether you have ...
0
votes
1answer
89 views

Malicious HTTP Post reuqest decoding

I have this request in my traffic, which is posting data to a malicious php file. T 212.193.229.17:60601 -> 9.9.9.9:80 [A] POST /images//sh.php HTTP/1.0. Host: dpfremovalwarrington.co.uk. X-Real-...
0
votes
1answer
191 views

What is causing ping sweep?

I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server. The traffic shows sequential pings sent to private ranges only. Eg: 192.168.1.1 192.168.1.2 192.168.1.3 ...
0
votes
1answer
260 views

hiden iframe unescape

started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server: <script>eval(unescape('%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%...
0
votes
1answer
349 views

outgoing DNS flood targeted to non-ISP hosts

Below is the specific traffic monitored at the network perimeter and originating from a user PC on Vista platform. My question is not about the effects of the flood, but about the nature of the ...
-2
votes
1answer
59 views

Random port in Filtered state for brief amount of time found using nmap , possible trojan?

Nmap results show me port 3527 open for brief period of time and then it disappears. I have a feeling this could be trojan communicating with mothership. Or something normal, but I cannot find much ...
3
votes
0answers
99 views

Linux Malware Detection Monitoring: Clean files after hit

I'm using LMD ("Maldet") for scanning a web server with different projects. For this purpose I'm using the inotify-monitoring. Well, the inotify-log shows, that the modified files are noticed, but I ...
2
votes
0answers
560 views

Slowloris on Apache: is mod_reqtimeout + mod_qos enough?

I detected few days ago that my server was under slowloris attack (I found a lot of "-" 408 0 "-" "-" values in my access.log). I changed my configuration like this: In mod_reqtimeout: ...
1
vote
0answers
68 views

Is it possible to check the progress of of a currently running clamAV scan?

I have searched around but not found a possible solution to this so far. I have an ongoing scan which I thought would've been finished at certain time, but unfortunately it has not. So I am wondering ...
1
vote
0answers
26 views

LMD/Maldetect: Missing target-file operand after

After running mallet 1.5 in screen-mode (# maldet -a /var/www) I'm getting this return: maldet(6070): {scan} 618017/618044 files scanned: hits 0 cleaned/usr/bin/wc: /usr/local/maldetect/tmp/.sess....
1
vote
0answers
44 views

Windows app not allowing debugging

I'll start by saying, I am not sure if this should go in StackOverflow or ServerFault. I posted it in StackOverflow earlier, but its been getting votes to close the question, so I assume it should be ...
1
vote
0answers
572 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
1
vote
0answers
100 views

SBS client can suddenly not access Internet, had Kryptik trojan

I have a question regarding Windows Small Business Server 2011. Yesterday, one of the computers in our domain was suddenly no longer able to connect to the Internet. It was still able to access all ...
1
vote
0answers
366 views

Scan a NAS Device with Microsoft Forefront Endpoint Protection

We are having problems with viruses sneaking through our virus scanner and onto our NAS and I want to scan the whole NAS. If I attempt to run a scan on the whole drive using the GUI for Forefront ...
0
votes
0answers
28 views

Suspicious domains in DNS logs

I'm seeing a lot of domains in our networks DNS logs (recursive) that all seem to be related and all return some sort of hash on port 80 Does anyone know what software is using them? ...
0
votes
0answers
14 views

Directories in the shared server in hosting turns shortcut icon

I'm just new to this server administration. I'm still finding my ways. We have site that is hosted in HOSTWAY. In my FTP I can see that my directories has turn its Icon as shortcut. We hosted ...
0
votes
0answers
23 views

Trying to find a trojan with Auditctl. Not enough information

So I have a website in Wordpress that keeps getting infected and starts sending spam emails. I have set up rules on AuditCTL on my Centos 6 server to find the culprit script but the information is ...
0
votes
0answers
30 views

How to fully track file creation on Centos

I have a server with CentOS which keeps getting infected. The infection always creates a file called post.php in httpdocs which starts sending emails. By default in Linux I can only see owner of the ...
0
votes
0answers
46 views

using testdisk to restore old superblock, cryptowall3.0 restoration

I have a drive that was infected with cryptowall3.0 Documentation states that the file is deleted and then from memory a new file is encrypted and that memory file is rename. Hypothetically restoring ...
0
votes
0answers
342 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
0
votes
0answers
276 views

Suspicious “sys0972500-1.php”, I didn't put it on my server

Before 2 days I found inside the httpdocc a new folder which name was css. Inside this folder I found a file named sys0972500-1.php , which it caused send thousands spam emails from my server. I ...