The tag has no wiki summary.

learn more… | top users | synonyms

-2
votes
1answer
41 views

Random port in Filtered state for brief amount of time found using nmap , possible trojan?

Nmap results show me port 3527 open for brief period of time and then it disappears. I have a feeling this could be trojan communicating with mothership. Or something normal, but I cannot find much ...
0
votes
1answer
202 views

False positive rate of CBL

We've come into the office (30+ networked systems) this morning to find that our email server is blacklisted on the CBL for: This IP address is infected with, or is NATting for a machine infected ...
-1
votes
1answer
2k views

How to get rid of ebury malware / trojan on Centos / cpanel [duplicate]

I have a server with cPanel installed on Centos 5.9. Three days ago, my server provider told me I'm infected by "Ebury Trojan". I read a lot of things saying that the openSSH server coming with ...
1
vote
2answers
403 views

How to find any file that is an executable or library

Let's say someone provides you with a tarball, saying it is source code and nothing else. You want to make sure that is true, and that no virus-laden executables or libraries are tucked away in a ...
-1
votes
1answer
71 views

Malicious program changing my DNSs [closed]

Some weeks ago I started having problems with my internet connection, it was extremely slow and suddently some websites (specifically gmail, facebook, youtube and twitter) started failing to connect, ...
1
vote
2answers
51 views

Program to log when files are written to a folder

One of our companies server seems to have fallen victim to a php backdoor attack. I've managed to located and close several holes, but one seems to persist that is writing a php/webshell backdoor ...
1
vote
0answers
89 views

SBS client can suddenly not access Internet, had Kryptik trojan

I have a question regarding Windows Small Business Server 2011. Yesterday, one of the computers in our domain was suddenly no longer able to connect to the Internet. It was still able to access all ...
0
votes
2answers
121 views

Trojan of Web-server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In our web-server most of the sites are infected with this JS-Downloader Trojan. It injected the following code. I've tried to ...
2
votes
1answer
6k views

Detecting Torpig on a LAN

I am responsible for the oversight of the LAN at a college campus. Recently we started getting blacklisted by CBL because someone on our LAN is infected with Torpig (AKA Anserin). The suggestion ...
0
votes
1answer
165 views

windows xp home security Trojan.FakeAlert - virus/scareware/malware

We have just had our second outbreak of a variant of the Windows XP home security malware (malwarebytes called it Trojan.fakeAlert). It manages to kill our antivirus (nod 32), and then kill attempts ...
1
vote
2answers
250 views

addthis_widget detected as virus

We use sunbelts VIPRE enterprise systems, and I was alerted to almost every computer in the company having this and being quarantined. Is anyone familiar with addthis_widget.js. It detects it as a ...
1
vote
5answers
222 views

how is it possible that a hacker could have inserted a piece of javascript code at the bottom of several of my pages

Somehow some javascript code got appended to the bottom of several of my index pages on my site. I know it's a trojan or iframe attack. However, I am wondering how is it even possible that someone ...
2
votes
5answers
864 views

Google is blocking our requests due to “automated queries”; what's the best way to find out why?

This started a few weeks ago and we thought it was a virus so we checked every computer and all though 50%(Yeah, that's right) were infected once they were cleaned the problem didn't go away. It's ...
0
votes
3answers
1k views

My website is infected with JS:ScriptIP-inf [Trj]

I am using Network Solutions hosting. I was recently attacked with JS:Illredir-S [Trj], I asked my hosting providers to clean it and they cleaned it and updated all passwords, but now after a week my ...
0
votes
1answer
70 views

Files deleted. What could have happened?

I'm having a weird issue today. I was writing and testing out some simple cgi scripts this morning when I realized that I couldn't run them from one of the other computers on the (windows) network. So ...
2
votes
6answers
275 views

What's the common cause for trojan downloaders on linux servers?

On several of the webservers i'm responsible for there's a javascript virus, a trojan downloader according to the antivirus i'm using. It's a minified javascript that's on the bottom of every page ...
1
vote
1answer
291 views

DNSHost.exe trojan found, now after fix, no one can print

What started today as an inability to get to the internet (but people could get in just fine), morphed to we realized that the DNS Server wasn't working, then we figured out that we had a trojan ...
0
votes
1answer
47 views

Removing a control kit from the server

The server my site is on was infected using the (pardon my obfuscation) Y-E-S E-x-p-l-o-i-t S-y-s-t-e-m It is a "control kit". I found out some info about it from ...
0
votes
2answers
235 views

Symantec - Flagging every local HTML file on my computer as a virus

I just ran Symantec Anti-Virus and it's flagging literally every since HTML,PHP,ASP/ASPX file on my computer as a virus. That's nearly 600 files on my laptop. Can this be? How can a text file ...
0
votes
2answers
402 views

How do you remove the “ffsearcher” trojan?

Does anyone have any experience in removing the ffsearcher trojan. One of our systems is infected. The virus scanner doesn't detect it, but our websense program is detecting all the internet ...