The tag has no wiki summary.

learn more… | top users | synonyms

-5
votes
1answer
56 views

How to check if any malevolent scripts are running on the server? [closed]

I want to give some small jobs to freelancers who would have FTP access to my websites hosted on my server. I heard that sometimes it's possible they put malevolent scripts and software on the ...
0
votes
2answers
94 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...
-1
votes
1answer
154 views

My website redirects to malware link [duplicate]

I coded my own website and uploaded to a host. Some days ago I realized that in front page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects ends up at: ...
0
votes
1answer
97 views

sed comand - remove virus from wordpress [duplicate]

I have malicious code in every php file. This malicius code is auto paste at the beginning of file. I want to remove this with UNIX command from console. This is malicious code: <?php ...
1
vote
2answers
67 views

Unknown issue taking down client machines, virus or coincidence

I’m sorry if this should be on SuperUser instead of ServerFault. Please ask me to migrate the question instead of flaming. I’ve had 2 windows desktops go down on the network in the space of one ...
1
vote
1answer
78 views

malware infected server respawing of files [duplicate]

So I have a clients server that is infected with malware. Basically any index.php file on the server was infected as well as header.php, function.php. The infection seems to be primarily wordpress ...
-2
votes
2answers
126 views

Conficker Virus Infection: Where did it start? [closed]

I have a network-wide Conficker infestation, and we have been working on starting virus scans on all our servers and workstations. It is being erased one by one, but I was wondering if there is a ...
4
votes
1answer
158 views

Server Side Virus Scanning

We have basic server-side virus scanning in our datacenter, but it's expensive, uses a considerable amount of CPU cycles, and is annoying to maintain. I'm not looking for a sales-pitch on "better" AV ...
0
votes
1answer
75 views

Small business server 2011 standard - applications randomly closing for remote desktop users

Small business server 2011 standard - applications randomly closing for remote desktop users I have an issue where when you are connected through remote desktop (doesn't matter whether you have ...
0
votes
1answer
241 views

Almost all of our websites within our server is redirecting to a porno scammy sites [duplicate]

We are having a problem within our server. After transferring the files to a new dedicated server, within only one or two weeks almost every website under our server is redirecting to a porno scammy ...
-5
votes
1answer
54 views

Why is the Anti Virus Definition file only 200MBs? [closed]

So I downloaded a virus definition file for symantec endpoint protection. We regularly update our client's closed network anti virus using these files once every 6 months. The files are of '.JDB' ...
0
votes
2answers
40 views

Do these files look like virus remnants?

We've been having Backup Exec issues related to a corrupt file within SYSVOL on an SBS 2008 server. An anti-virus scan removed a file (the same one BE was failing on) from within the scripts folder as ...
0
votes
1answer
195 views

Centos5 /tmp/.xzibit Displays multiple viruses in clamav, Can I delete this directory safely? [duplicate]

Possible Duplicate: How do I deal with a compromised server? I did a scan on my entire vps finding the folder above with a good amount of viruses. Can I safely delete this folder? Can I ...
1
vote
2answers
613 views

How to find any file that is an executable or library

Let's say someone provides you with a tarball, saying it is source code and nothing else. You want to make sure that is true, and that no virus-laden executables or libraries are tucked away in a ...
0
votes
1answer
245 views

Google and Yahoo redirect my site to malware, but direct url works fine. Any computer [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I can go directly to the site doublewing.org or www. without issue, but if I click on the link in google or yahoo it redirects to spam ...
0
votes
1answer
87 views

Our clients site is redirecting to a pill scammy site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We've usually host our clients site, but we aren't hosting this one. The website itself (weddle-funeral.com) works just fine. if ...
1
vote
1answer
2k views

Folders on our server2003-share are being “hidden”, replaced by .exe files

We have had following problem on our Windows2003 server for weeks now, every day the folder on our share are being made hidden and replaced by .exe files with the same names as the original folders. I ...
0
votes
1answer
147 views

What is causing ping sweep?

I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server. The traffic shows sequential pings sent to private ranges only. Eg: 192.168.1.1 192.168.1.2 192.168.1.3 ...
1
vote
1answer
104 views

Hyper-V or VMware - Find all modifications/changes made between 2 Snapshots

I would like to use either Hyper-V or Vmware in order to find out after taking a Clean Base snapshot and a modified snapshot and what the modifications/differences and what was changed between the two ...
0
votes
1answer
521 views

Allowing any file to upload on server and security risks

We are having a project that allows users to backup there data to server through php upload,running on Linux server. If users upload any executable file it will be automatically renamed to some ...
2
votes
1answer
520 views

I have many strange requests in my httpd access_log, does it mean I have a virus?

I have httpd log information as such which goes on and on forever. Firstly, does this mean I have a virus? is my server part of a botnet? My server is Linux Centos 5. tail -f ...
2
votes
4answers
4k views

HP Printer Malfunction (Virus?)

i'm having serious problems with several HP Printers. The issue is the following: my printer (different models) prints random ASCII character on the first line of a paper ( image sample: ...
-3
votes
1answer
148 views

How do I remove a rootkit without an anti-rootkit program? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Windows 2000 Server. I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely ...
-1
votes
1answer
135 views

Virus creates exe files with text content [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Something automatically creates exe files like "zytudou.exe" on my PC with text content: open 122.138.203.175 123 123 get ...
1
vote
3answers
867 views

Recurring virus infection on a domain workstation

One of our users is having a recurring problem with a virus. It has happened to this user on two different machines, in each instance infecting the same program with the same virus. Malware bytes ...
1
vote
3answers
1k views

Scan whole system or just user dirs with clamav

I'm in doubt about how to scan my Linux system with Clamav: do I just scan the places where users can upload files (homedirs, their webroots) or do I scan the whole system? The various sites I've ...
0
votes
1answer
556 views

Critical Virus infection with PHP website. What are the options to remove Virus? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have a critical virus infection to one of my website. There is a additional script found added at footer of few web pages . the ...
0
votes
2answers
861 views

How to remove .htaccess virus [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Subdomain folder with root folder they write a .htaccess file with this code <IfModule mod_rewrite.c> ...
7
votes
3answers
1k views

Can a virus spread through a network share used by an RDP connection?

When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote ...
9
votes
3answers
801 views

Postfix sending and receiving the same e-mail every 5 minutes for 4+ months

Back in June I sent myself the EICAR test signature to make sure my postfix/amavis/spamassassin etc setup was working properly. I didn't notice at the time, but this somehow created a tear in the ...
0
votes
2answers
128 views

Trojan of Web-server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In our web-server most of the sites are infected with this JS-Downloader Trojan. It injected the following code. I've tried to ...
4
votes
2answers
527 views

Possible malware on my server, how to search the source?

Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears. The message is something like "The remote address has ...
2
votes
1answer
7k views

Detecting Torpig on a LAN

I am responsible for the oversight of the LAN at a college campus. Recently we started getting blacklisted by CBL because someone on our LAN is infected with Torpig (AKA Anserin). The suggestion ...
3
votes
3answers
140 views

Training High School Students on Security - What harmless “viruses” can I install that they can find?

I'm training some high school students interested in OS security (specifically, Windows Server 2003/2008), and though I've gone over a lot of the "in-theory" stuff, some hands on would be great. ...
0
votes
2answers
870 views

Strange email coming from/to my computer

I'm running smtp4dev on my machine to trap anything going in/out of my computer on port 25 for testing purposes. Every so often this email gets trapped and I have no idea what it's from. I have ...
2
votes
2answers
1k views

Symantec Endpoint Protection Virus Definitions

I have done some Googling but I cannot get a definitive answer certainly not from the Symantec KB. I have a Virtualised Win 2003R2 server 32bit. It has been provisioned to me with Symantec Endpoint ...
0
votes
2answers
83 views

Host File Redirect From Virus

I have a clients laptop that is doing the redirect of web pages to other sites. I have run HitManPro and Combofix and they didn't come up with anything major. There is no proxy set in Internet ...
0
votes
3answers
107 views

Dedicated Server hit with viruses

Since setting up my dedicated server I have been hit with many viruses. 1 would eat up my bandwidth and another is currently sending out trojans to any outgoing mail from my mail server. Is there a ...
1
vote
0answers
294 views

Scan a NAS Device with Microsoft Forefront Endpoint Protection

We are having problems with viruses sneaking through our virus scanner and onto our NAS and I want to scan the whole NAS. If I attempt to run a scan on the whole drive using the GUI for Forefront ...
0
votes
1answer
171 views

windows xp home security Trojan.FakeAlert - virus/scareware/malware

We have just had our second outbreak of a variant of the Windows XP home security malware (malwarebytes called it Trojan.fakeAlert). It manages to kill our antivirus (nod 32), and then kill attempts ...
1
vote
2answers
272 views

addthis_widget detected as virus

We use sunbelts VIPRE enterprise systems, and I was alerted to almost every computer in the company having this and being quarantined. Is anyone familiar with addthis_widget.js. It detects it as a ...
-1
votes
2answers
136 views

cann anyone solve this questino? [closed]

Routers on the internet never forward packets coming from private IP addresses Explain. Can you see any advantage in this?
0
votes
1answer
660 views

How Can I Disable \PIPE\svcctl in Group Policy?

This is more of a networking question than a programming question. There is a virus running amok on our network at work and it seems to be taking down our servers. I have determined that the virus ...
2
votes
3answers
117 views

Avoiding viruses 101

I'm looking to send out an email to my users to give them advice on avoiding getting viruses and phishing emails. I've found http://www.sonicwall.com/furl/phishing/ which is a bit dated and is ...
24
votes
2answers
4k views

Unusual HEAD requests to nonsense URLs from Chrome

I have noticed unusual traffic coming from my workstation the last couple of days. I am seeing HEAD requests sent to random character URLs, usually three or four within a second, and they appear to be ...
2
votes
4answers
645 views

Virus blocking incoming connections?

On my Windows Server 2003 server, all incoming connections are dropped. I can see them getting in using Wireshark, but even a single ping from another computer fails. All locally initiated connection ...
2
votes
3answers
648 views

Force Apache2.2 to drop a request

Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a ...
2
votes
3answers
330 views

What would you do when a worm infects everything?

Ive always wondered, what can we do if a virus or worm happens to affect the main file server? What if from the file server the clients get infected by said worm/virus? How would you clean it up? ...
0
votes
1answer
335 views

Possible causes for Domain server being unavailable? [duplicate]

Possible Duplicate: Reinstall after a Root Compromise? One of our servers was compromised after a user with administrative privileges accidentally loaded a virus from a USB drive on a ...
0
votes
3answers
143 views

What options do I have for virus protection on windows server 2008 (this server is not a mail server)?

I would like to use some kind of virus protection on the server. What options do I have? I installed MS security essentials, but I just learned that I is not for commercial/government use.