Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
2answers
1k views

High CPU load on Centos with process sync_supers

My centos server has high cpu load right now. Please see the Htop output below. sync_supers is very suspected but I don't know how to kill it. Any suggestions?
0
votes
2answers
391 views

Removing VirTool:Win32/VBInject.gen!DG

i get this little bugger poping up every start up, my microsoft security essentials stops initial attempt and there no threat till next start up. I was wondering, if there any tools to check and ...
2
votes
1answer
230 views

WMI query of DNS shows a root hint that's not present in the DNS plugin.

I was writing a Powershell script for my network when I came across some alarming information in our DNS. Bear in mind we still use Powershell v2, not v3. So I have to query DNS via the Get-WMI ...
1
vote
1answer
43 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
1
vote
1answer
441 views

Identifiying weird chinese registry entries in CurrentControlSet\Services

I noticed chinese characters inside my register under HKLM\System\CurrentControlSet\Services. Inside these there was nothing. I googled the strings and found nothing. Anyway for me to identify these? ...
0
votes
1answer
189 views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
0
votes
1answer
115 views

How to remove crypto-ransomware on my network domain

Today some computer on my domain got infected with crypto-ransomware and have infected some folders on file server that only some computers on network have access to. So I presume one or more of five ...
0
votes
1answer
93 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
0
votes
1answer
85 views

Small business server 2011 standard - applications randomly closing for remote desktop users

Small business server 2011 standard - applications randomly closing for remote desktop users I have an issue where when you are connected through remote desktop (doesn't matter whether you have ...
0
votes
1answer
83 views

Malicious HTTP Post reuqest decoding

I have this request in my traffic, which is posting data to a malicious php file. T 212.193.229.17:60601 -> 9.9.9.9:80 [A] POST /images//sh.php HTTP/1.0. Host: dpfremovalwarrington.co.uk. ...
0
votes
1answer
158 views

What is causing ping sweep?

I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server. The traffic shows sequential pings sent to private ranges only. Eg: 192.168.1.1 192.168.1.2 192.168.1.3 ...
0
votes
1answer
214 views

hiden iframe unescape

started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server: ...
0
votes
1answer
326 views

outgoing DNS flood targeted to non-ISP hosts

Below is the specific traffic monitored at the network perimeter and originating from a user PC on Vista platform. My question is not about the effects of the flood, but about the nature of the ...
-2
votes
1answer
50 views

Random port in Filtered state for brief amount of time found using nmap , possible trojan?

Nmap results show me port 3527 open for brief period of time and then it disappears. I have a feeling this could be trojan communicating with mothership. Or something normal, but I cannot find much ...
2
votes
0answers
35 views

Linux Malware Detection Monitoring: Clean files after hit

I'm using LMD ("Maldet") for scanning a web server with different projects. For this purpose I'm using the inotify-monitoring. Well, the inotify-log shows, that the modified files are noticed, but I ...
2
votes
0answers
331 views

Slowloris on Apache: is mod_reqtimeout + mod_qos enough?

I detected few days ago that my server was under slowloris attack (I found a lot of "-" 408 0 "-" "-" values in my access.log). I changed my configuration like this: In mod_reqtimeout: ...
1
vote
0answers
34 views

Windows app not allowing debugging

I'll start by saying, I am not sure if this should go in StackOverflow or ServerFault. I posted it in StackOverflow earlier, but its been getting votes to close the question, so I assume it should be ...
1
vote
0answers
314 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
1
vote
0answers
92 views

SBS client can suddenly not access Internet, had Kryptik trojan

I have a question regarding Windows Small Business Server 2011. Yesterday, one of the computers in our domain was suddenly no longer able to connect to the Internet. It was still able to access all ...
1
vote
0answers
319 views

Scan a NAS Device with Microsoft Forefront Endpoint Protection

We are having problems with viruses sneaking through our virus scanner and onto our NAS and I want to scan the whole NAS. If I attempt to run a scan on the whole drive using the GUI for Forefront ...
0
votes
0answers
22 views

How does FireAmp (anti-malware) actually work?

Several companies I know of are rolling out an anti-malware product called FireAMP. The publisher's website is long on hype and short on technical details. How does the product actually work? I'm ...
0
votes
0answers
12 views

Defunct process Rev1112

We were having the following output in top on a Debian box on XenServer: top - 10:00:55 up 10 days, 24 min, 5 users, load average: 126.79, 128.96, 71.39 Tasks: 10382 total, 1 running, 4801 ...
0
votes
0answers
151 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
0
votes
0answers
53 views

Maldetect Ignore List Not Being Honoured

I'm using Maldetect on CentOS to scan for malware on my server. I have hundreds of thousands of audio files on my server which I do not want scanned. According to the README: ...
0
votes
0answers
269 views

Suspicious “sys0972500-1.php”, I didn't put it on my server

Before 2 days I found inside the httpdocc a new folder which name was css. Inside this folder I found a file named sys0972500-1.php , which it caused send thousands spam emails from my server. I ...
0
votes
0answers
48 views

BIND Configuration for malware analysis

we are working on a project to analyse the traffic generated by bots in a enterprise network isolated from internet. I would like to configure the BIND in this network to direct all otherwise ...
0
votes
0answers
227 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...