The system-compromise tag has no wiki summary.
0
votes
1answer
63 views
Malicous Iframe appearing on website [duplicate]
One of the websites which I look after appears to have been compromised. However I am still trying to locate the source of the problem.
A hidden iframe appears on the page, however it only appears ...
0
votes
0answers
29 views
Finding proof of server being compromised by Black Hole Toolkit exploit [duplicate]
Possible Duplicate:
My server’s been hacked EMERGENCY
I recently took over maintenance of a company server. (Just Host, C Panel, Linux server), theres a tonne of websites on it which i know ...
9
votes
10answers
886 views
Pull network or power? (for contianing a rooted server)
When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
10
votes
3answers
724 views
Finding how a hacked server was hacked
I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do?
The best answer is ...
240
votes
10answers
39k views
How do I deal with a compromised server?
This is a Canonical Question about Server Security - Responding to Breach Events (Hacking)
See Also:
Tips for Securing a LAMP Server
Reinstall after a Root Compromise?
Canonical ...
0
votes
2answers
252 views
Strange Items in Hosts File and Netstat
I ran a netstat -a on a computer and there were a number of strange items:
Proto Local Address Foreign Address State
TCP netgym:epmap virusin:0 LISTENING
...
0
votes
1answer
302 views
ld library problem
I am getting the below error while checking status of any service or stoping starting any server on my linux server. Its CentOS-5.4 server.
sh: /usr/bin/(swapd): /lib/ld-linux.so.1: bad ELF ...
3
votes
2answers
188 views
My website is infected, I restored a backup of the uninfected files, how long will it take to un-mark as dangerous?
My website www.sagamountain.com was recently infected by a malware distributor (or at least I think it may have been).
I have removed all external content, google ads, firefly chat, etc.
I uploaded ...
