Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

25
votes
2answers
4k views

Unusual HEAD requests to nonsense URLs from Chrome

I have noticed unusual traffic coming from my workstation the last couple of days. I am seeing HEAD requests sent to random character URLs, usually three or four within a second, and they appear to be ...
12
votes
13answers
4k views

Make browsing safe for porn surfers

At several places I've done some work at, I have a suspicion that some of the executives browse porn on their work computers. It appears this porn surfing has lead to virus infections on their ...
12
votes
4answers
1k views

How do I deal with the removal/eradication of an unknown worm on our network?

TL;DR I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
10
votes
4answers
717 views

Updating Malware cleaning skills

I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
10
votes
6answers
12k views

What is the best way to find Conficker infected PCs in company networks remotely?

What is the best way remotely to find Conficker infected PCs in company/ISP networks?
10
votes
7answers
2k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
10
votes
5answers
1k views

Prevent execution of Windows executables

Is there any way to tell Windows (XP and above) not to execute files (*.exe files), which are present in drives/folders other than certain folders, that I mention? In short I want executables from ...
10
votes
3answers
868 views

Postfix sending and receiving the same e-mail every 5 minutes for 4+ months

Back in June I sent myself the EICAR test signature to make sure my postfix/amavis/spamassassin etc setup was working properly. I didn't notice at the time, but this somehow created a tear in the ...
9
votes
1answer
669 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
8
votes
5answers
285 views

Securing Acrobat Reader to mitigate viruses

Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...
8
votes
2answers
2k views

Why are NginX and Lighttpd not affected by Slowloris?

I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works. What I don't understand is why Lighttpd and NginX are not affected (according to the ...
7
votes
5answers
23k views

how to find out what created a file?

I have some virus files being randomly created on root of a c: disk of one of my servers. How can I find out what created it? Some 3rd party software maybe?
7
votes
3answers
4k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
7
votes
3answers
2k views

Can a virus spread through a network share used by an RDP connection?

When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote ...
6
votes
5answers
301 views

Kids + older computers + our network at the office: Security risk?

On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
6
votes
12answers
741 views

Hardening a financially critical Windows computer

One of the risks to small and medium businesses is losing your bank credentials to bad guys by use of a key logger or other malware as Bruce Schneier blogs about. A particular threat is real-time key ...
5
votes
8answers
3k views

How can I test if a website is infected with malware?

Some friends of mine have a website (www.kennelsoffie.dk) and I'm trying to help them when there is any trouble. However this time I, can't figure it out. When I visit the site using Google Chrome, ...
5
votes
1answer
747 views

How to scan uploaded file for virus on linux?

Just like the title, is there any antivirus that i can run from command prompt on linux to make sure user uploaded files are virus free? Thank you!
4
votes
3answers
454 views

Some questions about the Microsoft Windows Malicious Software Removal Tool (MRT)

Does this program automatically run? If so, when and how often? Is it automatically updated? How do you disable it? How can you tell if it is running? What versions of Windows is it installed on?
4
votes
4answers
998 views

Should I upgrade to Symantec Endpoint Protection? [closed]

I'm the IT manager at an animal shelter in Upstate New York. We have a Windows network with about 50 desktops running Windows XP Pro. We used to use CA eTrust Antivirus, but that product didn't work ...
4
votes
5answers
4k views

Best Open Source or Freeware Malware/Spyware/Antivirus with centralized management? [closed]

What are the best Malware/Spyware/Antivirus solutions? Several requirements for the solution: Open Source or Freeware Centralized Management Reporting and Remote Installation Think spybot / ...
4
votes
1answer
198 views

Server side antivirus or not?

We have basic server-side virus scanning in our datacenter, but it's expensive, uses a considerable amount of CPU cycles, and is annoying to maintain. I'm not looking for a sales-pitch on "better" AV ...
4
votes
5answers
851 views

Conficker: Should steps taken in group policy to secure against virus remain?

We got nailed two weeks ago by Conficker, I ran through the 26 step checklist from Mircrosoft on my own computer, as well as on our domain server. It says near the end to reverse all the changes, but ...
4
votes
2answers
539 views

Possible malware on my server, how to search the source?

Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears. The message is something like "The remote address has ...
3
votes
10answers
1k views

google result redirect virus

I'm not so sure if this is the appropriate place for this, however I accidentally clicked this link which opened a video and infected my windows 2003 std server with this virus which not only creates ...
3
votes
2answers
1k views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
3
votes
2answers
1k views

How do I repair dhcp service after conficker infection on Windows 2003 Server?

How do I repair dhcp service after conficker infection on Windows 2003 Server? If the server is restarted with DHCP then it keeps attempting to acquire a network address. It seems to work fine if ...
3
votes
2answers
217 views

My website is infected, I restored a backup of the uninfected files, how long will it take to un-mark as dangerous?

My website www.sagamountain.com was recently infected by a malware distributor (or at least I think it may have been). I have removed all external content, google ads, firefly chat, etc. I uploaded ...
3
votes
2answers
10k views

Strange scheduled tasks on Windows Server 2003

A few days ago, I noticed that our Windows Server 2003 system has strange scheduled tasks. I do not know where they came from or who set them up. I deleted them and they came up again today. They have ...
3
votes
1answer
244 views

Does anyone recognize this e-mail sniffer or malware using ROT13 encoding?

I have a private website that every week sends e-mails with two different http links to a group of around 30 people. When a link is clicked, the answer is registered in a database. Starting last week, ...
3
votes
1answer
287 views

Google Web History shows

Google Web History Trends is showing URLs such as the following for 4 out of 10 of my Top Clicks (including the top 2): http://ocean2-4979731.org/page/0.volume ...
3
votes
2answers
200 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
3
votes
2answers
2k views

Privoxy rule to block Facebook spying

Recently, my server's Privoxy rules to block Facebook's spying have failed. How can I block current Facebook spying links? Since soon after the inception of Facebook's so-called “Open Graph” ...
3
votes
1answer
2k views

Cisco reputation filters mis-identified site as malware or “misconfigured DNS”

A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
2
votes
6answers
2k views

Websites on Ubuntu 8.04 LTS with Plesk are infected with viruses [duplicate]

I am running Plesk 9.5 on Ubuntu 8.04 LTS and have about 15 websites infected with some malicious code appended to the end of java files. I have installed Clamav and it has managed to pickup the ...
2
votes
3answers
629 views

how i can write test virus?

i have a website and in website some people can upload files .... and when user upload file it must scan from virus by antivirus ... so i need test virus have the following extention (.doc ,jpg, png, ...
2
votes
5answers
890 views

What is the process of cleaning viruses from a network?

We have a problem with a network virus that spread through our network and most computers have been infected. What should I do to remove the virus? By installing and scanning anti-virus software, the ...
2
votes
5answers
1k views

Google is blocking our requests due to “automated queries”; what's the best way to find out why?

This started a few weeks ago and we thought it was a virus so we checked every computer and all though 50%(Yeah, that's right) were infected once they were cleaned the problem didn't go away. It's ...
2
votes
5answers
238 views

Do you maintain an OMG it's !@#$ed CD with Utilities to recover and clean computers? What is on it? [closed]

I'm getting ready to build one with some of the common apps I use including malwarebytes, Spybot, and memtest86 . What elese do you recommend I add? Is there a single CD image out there that has all ...
2
votes
2answers
279 views

Why computer scanning network?

I have found out through Wireshark that a computer in my subnet scanning network ( sending ARPs for every IP-address in my subnet. Even if there no computers with such address). It repeats ...
2
votes
3answers
331 views

What would you do when a worm infects everything?

Ive always wondered, what can we do if a virus or worm happens to affect the main file server? What if from the file server the clients get infected by said worm/virus? How would you clean it up? ...
2
votes
3answers
361 views

Do we need both Eset and SuperAntiSpyware?

Our company had a bad virus experience several years ago. Probably as a result, every pc has Eset Nod & SuperAntiSpyware installed. I think this is excessive and that Eset should allow sufficient ...
2
votes
4answers
360 views

Website attacked with a hidden iframe (q5x.ru)

A website of mine has recently been infected with some sort of attack that involved injecting a hidden iframe, and it's source was from a site q5x.ru (do not link). A Google search didn't help me in ...
2
votes
6answers
284 views

Do my macs need anti-virus/ malware products?

This caused flame war in my Mac Users group, but the recent advisory that Apple released and then pulled suggesting using Anti-virus products. My take is that it's worth being safe rather than sorry, ...
2
votes
3answers
453 views

Do I need to deploy antivirus and anti-spyware software to all the PCs on my network?

I am already using antivirus on all our PCs, and, of course, we're behind a firewall. Does anti-spyware software like adaware still provide an additional benefit, or does modern antivirus/firewall ...
2
votes
1answer
558 views

I have many strange requests in my httpd access_log, does it mean I have a virus?

I have httpd log information as such which goes on and on forever. Firstly, does this mean I have a virus? is my server part of a botnet? My server is Linux Centos 5. tail -f ...
2
votes
1answer
704 views

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
2
votes
6answers
278 views

What's the common cause for trojan downloaders on linux servers?

On several of the webservers i'm responsible for there's a javascript virus, a trojan downloader according to the antivirus i'm using. It's a minified javascript that's on the bottom of every page ...
2
votes
3answers
251 views

Rebuild or repair? [duplicate]

Possible Duplicate: Updating Malware cleaning skills I was having an argument the other day regarding damaged systems. If a system has a hard to eradicate virus, etc, or has been damaged ...
2
votes
4answers
4k views

HP Printer Malfunction (Virus?)

i'm having serious problems with several HP Printers. The issue is the following: my printer (different models) prints random ASCII character on the first line of a paper ( image sample: ...