The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
2answers
156 views

Determine from where is “sh” being run under apache www-data user using using PF or NETSTAT [duplicate]

I am working with a compromised Ubuntu 8.04 Plesk 9.5.4 server. It seems that a script on the server is continuously doing reverse lookups to random IPs on the Internet. I first spotted it during by ...
0
votes
1answer
92 views

Malicous Iframe appearing on website [duplicate]

One of the websites which I look after appears to have been compromised. However I am still trying to locate the source of the problem. A hidden iframe appears on the page, however it only appears ...
10
votes
10answers
995 views

Pull network or power? (for contianing a rooted server)

When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
11
votes
3answers
868 views

Finding how a hacked server was hacked

I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do? The best answer is ...
307
votes
12answers
54k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
0
votes
2answers
332 views

Strange Items in Hosts File and Netstat

I ran a netstat -a on a computer and there were a number of strange items: Proto Local Address Foreign Address State TCP netgym:epmap virusin:0 LISTENING ...
0
votes
1answer
410 views

ld library problem

I am getting the below error while checking status of any service or stoping starting any server on my linux server. Its CentOS-5.4 server. sh: /usr/bin/(swapd): /lib/ld-linux.so.1: bad ELF ...
3
votes
2answers
210 views

My website is infected, I restored a backup of the uninfected files, how long will it take to un-mark as dangerous?

My website www.sagamountain.com was recently infected by a malware distributor (or at least I think it may have been). I have removed all external content, google ads, firefly chat, etc. I uploaded ...