Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

12
votes
4answers
1k views

How do I deal with the removal/eradication of an unknown worm on our network?

TL;DR I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
10
votes
4answers
707 views

Updating Malware cleaning skills

I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
10
votes
7answers
1k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
9
votes
1answer
653 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
8
votes
5answers
284 views

Securing Acrobat Reader to mitigate viruses

Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...
6
votes
5answers
298 views

Kids + older computers + our network at the office: Security risk?

On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
6
votes
12answers
736 views

Hardening a financially critical Windows computer

One of the risks to small and medium businesses is losing your bank credentials to bad guys by use of a key logger or other malware as Bruce Schneier blogs about. A particular threat is real-time key ...
5
votes
8answers
3k views

How can I test if a website is infected with malware?

Some friends of mine have a website (www.kennelsoffie.dk) and I'm trying to help them when there is any trouble. However this time I, can't figure it out. When I visit the site using Google Chrome, ...
4
votes
3answers
448 views

Some questions about the Microsoft Windows Malicious Software Removal Tool (MRT)

Does this program automatically run? If so, when and how often? Is it automatically updated? How do you disable it? How can you tell if it is running? What versions of Windows is it installed on?
4
votes
4answers
967 views

Should I upgrade to Symantec Endpoint Protection? [closed]

I'm the IT manager at an animal shelter in Upstate New York. We have a Windows network with about 50 desktops running Windows XP Pro. We used to use CA eTrust Antivirus, but that product didn't work ...
4
votes
5answers
4k views

Best Open Source or Freeware Malware/Spyware/Antivirus with centralized management? [closed]

What are the best Malware/Spyware/Antivirus solutions? Several requirements for the solution: Open Source or Freeware Centralized Management Reporting and Remote Installation Think spybot / ...
4
votes
2answers
527 views

Possible malware on my server, how to search the source?

Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears. The message is something like "The remote address has ...
3
votes
2answers
911 views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
3
votes
7answers
521 views

Users as local admins on Windows machines

I am in charge of a Windows-based network of over 70 computers at work. Servers are Windows Server 2008 and workstations are Windows Vista and Windows XP. Most users are researchers, and some of them ...
3
votes
3answers
140 views

Training High School Students on Security - What harmless “viruses” can I install that they can find?

I'm training some high school students interested in OS security (specifically, Windows Server 2003/2008), and though I've gone over a lot of the "in-theory" stuff, some hands on would be great. ...
3
votes
2answers
105 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
3
votes
1answer
2k views

Cisco reputation filters mis-identified site as malware or “misconfigured DNS”

A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
2
votes
2answers
272 views

Why computer scanning network?

I have found out through Wireshark that a computer in my subnet scanning network ( sending ARPs for every IP-address in my subnet. Even if there no computers with such address). It repeats ...
2
votes
6answers
279 views

Do my macs need anti-virus/ malware products?

This caused flame war in my Mac Users group, but the recent advisory that Apple released and then pulled suggesting using Anti-virus products. My take is that it's worth being safe rather than sorry, ...
2
votes
1answer
670 views

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
2
votes
2answers
243 views

Data Execution Prevention has closed the program Ms08n.exe

I've got a Windows2003 server which I rebooted recently, and now is nagging me about Data Execution Prevention having closed the program "Ms08n.exe". When I press "close message", the dialog just ...
2
votes
1answer
173 views

Does anyone recognize this e-mail sniffer or malware using ROT13 encoding?

I have a private website that every week sends e-mails with two different http links to a group of around 30 people. When a link is clicked, the answer is registered in a database. Starting last week, ...
2
votes
3answers
2k views

Debian webserver malware scanner

I was wondering if there was a malware scanner for websites with up to date exploits for use on a Debian webs server with Apache2.2? Vulnerability scanners are great, but I also want to be sure that ...
2
votes
3answers
100 views

Suggestions requested on what to cover in seminar on `Recent Trends in Virus & Anti-virus Stratagies`

I'm going to give a seminar on "Recent Trends in Virus & Anti-virus Strategies" as a part of my course work in my Post Graduation. I got two months of time. So, I want to fully utilize this ...
2
votes
1answer
474 views

Does windows 7 remember shared folder passwords to entire server instead of by share?

So I have a copy of Windows 7 Enterprise edition on my home computer. I've connected from the home computer to a network share on my windows 2003 server at work before. I assume that I told it to ...
2
votes
1answer
166 views

WMI query of DNS shows a root hint that's not present in the DNS plugin.

I was writing a Powershell script for my network when I came across some alarming information in our DNS. Bear in mind we still use Powershell v2, not v3. So I have to query DNS via the Get-WMI ...
1
vote
7answers
2k views

I am starting to think that Prevx.com isnt a legit site…but heres my long-winded question

I apologize in advance for the long-winded post. I posted it all because I believe its informative and may be useful. Also, I posted my question at the end. Moments ago I was RDC to a file server ...
1
vote
4answers
116 views

sendmail sending mail to recipients I don’t know of; possible spam host

Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday. STATISTICS ---------- Messages To Recipients: 582 Addressed Recipients: ...
1
vote
8answers
1k views

anti-virus / malware solution for small non-profit network

I'm an IT volunteer at a local non-profit. I'm looking for a good AV/malware solution. We currently use a mishmash of different client solutions, and want to move to something centralized. There is ...
1
vote
11answers
264 views

Bad results from malware cleanup tools?

As there's already a wiki regarding cleanup tools, are there any tools that have given you negative results (i.e. made the system worse)?
1
vote
2answers
1k views

Linux Stealth Process

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again... ...
1
vote
2answers
201 views

Mac server infected with spam agent

We have a huge trouble :( .. Our mac server makes a spam delivery. Our IP already blacklisted in about a dozen of servers (checked with http://mxtoolbox.com/). We have another computers in the same ...
1
vote
3answers
59 views

Blocking Invalid HTTP Requests to PHP Application

For the first time in a number of years, I'm semi-responsible for helping out with the server administration of a PHP web application (served out using Apache). We're seeing a number of requests for ...
1
vote
2answers
2k views

Got a malware on my hosting provider which infect JavaScript files .. how do I find the entry point?

This morning some sites which are hosted on the server as me started triggering malware alerts and started to redirect traffic to external sites. I've found out that a line of packed javascript was ...
1
vote
3answers
112 views

What sites/publications are good for staying current on security and malware trends? [duplicate]

Possible Duplicate: Security Resources In my ever expanding quest for knowledge, I'm at the point where I feel like I need to be more up to date with the current security trends, as well as ...
1
vote
3answers
159 views

Is it normal for port 23 to be connected to periodically?

While working at a customer site (a LAN that includes several Windows machines, plus our server) I noticed that something was periodically attempting to connect to our server on port 23 via TCP. ...
1
vote
2answers
238 views

One machine blocked from a single server, and only when it's at this physical location?

I host an e-commerce website for a client who suddenly is unable to access it from his computer. He can ping the server, he can SSH in, but cannot load the website in any browser we've tried: IE, ...
1
vote
2answers
33 views

Need a resource to find out about latest attack activity?

Thought about this seeing another question pop up about a user agent string showing up in the poster's logs; is there a site for sysadmins to go to for finding the latest information about ...
1
vote
2answers
47 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
1
vote
2answers
610 views

Best practices for isolating malware/honeypot samples

I am pursuing malware research and am wondering what are the best practices for building safe VM's to contain the code while disassembling it. So far: Each instance for examining the code is housed ...
1
vote
2answers
673 views

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of ...
1
vote
1answer
201 views

String search and replace across an entire database

After an exploit on an ASP.NET site, the client was left with a specific string of malware code sprayed across the entire database, multiple columns of multiple tables. The prepended string is ...
1
vote
1answer
2k views

Folders on our server2003-share are being “hidden”, replaced by .exe files

We have had following problem on our Windows2003 server for weeks now, every day the folder on our share are being made hidden and replaced by .exe files with the same names as the original folders. I ...
1
vote
1answer
104 views

Hyper-V or VMware - Find all modifications/changes made between 2 Snapshots

I would like to use either Hyper-V or Vmware in order to find out after taking a Clean Base snapshot and a modified snapshot and what the modifications/differences and what was changed between the two ...
1
vote
3answers
1k views

Scan whole system or just user dirs with clamav

I'm in doubt about how to scan my Linux system with Clamav: do I just scan the places where users can upload files (homedirs, their webroots) or do I scan the whole system? The various sites I've ...
1
vote
1answer
48 views

Administering forums on servers, seeing weird attacks

I'm not sure ServerFault is the correct place for such a question: please redirect if another StackExchange site is more appropriate but I think this is the "most correct" one. On one of the server ...
1
vote
2answers
109 views

md5sum or sha1sum of legitmate microsoft system files

Is there a database or repository of the legitimate checksums for Microsoft system files? We think we have a 0day on DNS for Windows 2003 SP2 using IRC for command and control. (Latest McAfee does not ...
1
vote
1answer
37 views

malicious files

can virus's/spyware/malware/trojans/worms get on your remote desktop/terminal services servers from a local machine?
1
vote
3answers
259 views

XP Pro SP3 unresponsive requires power down

New to serverfault, but searched google and the forums here and haven't found anything regarding my issue. I have two laptops in my network that are displaying similar issues. They are from different ...
1
vote
1answer
38 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...