The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
15 views

Virus sends mails via sendmail [duplicate]

I noticed that my server has some bad software that sends mails via sendmail which couses a very slow working. I scaned server with clamscan but without effect. Is there any way to find out which ...
0
votes
0answers
24 views

Suspicious process self with random name in Fedora 20 [duplicate]

When I run top I see a two processes run by root with all random letters(jycybezyxa and jycybezyxa): >Tasks: 246 total, 2 running, 236 sleeping, 0 stopped, 8 zombie >%Cpu(s): 15.3 us, ...
0
votes
0answers
19 views

My Hosting Infected with CryptoPHP Script Hostgator [duplicate]

Before 10days Hostgator migrated server to Indian Servers , and they said it is highly secure, As for more than 10 days i am getting problems in My backend word press plugins, So last 10 days i was ...
-1
votes
1answer
64 views

Server is trying to send out spam [duplicate]

My email server is attempting to send out a great deal of spam. I'm using Postfix & Dovecot. I'm trying to diagnose the problem and figure out how this is being sent. My guess right now is that ...
-1
votes
1answer
41 views

Backdoor:PHP/Shell.P keeps regenerating.Caught by Antivirus. [duplicate]

I have a windows server 2008 with PHP on it and a few Wordpress sites on it. I got a virus some time ago. I thought I had it deleted and everything was fine but after looking at my Quarantine section ...
-5
votes
1answer
57 views

How to check if any malevolent scripts are running on the server? [closed]

I want to give some small jobs to freelancers who would have FTP access to my websites hosted on my server. I heard that sometimes it's possible they put malevolent scripts and software on the ...
0
votes
2answers
108 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...
-1
votes
1answer
181 views

My website redirects to malware link [duplicate]

I coded my own website and uploaded to a host. Some days ago I realized that in front page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects ends up at: ...
0
votes
1answer
120 views

sed comand - remove virus from wordpress [duplicate]

I have malicious code in every php file. This malicius code is auto paste at the beginning of file. I want to remove this with UNIX command from console. This is malicious code: <?php ...
1
vote
2answers
68 views

Unknown issue taking down client machines, virus or coincidence

I’m sorry if this should be on SuperUser instead of ServerFault. Please ask me to migrate the question instead of flaming. I’ve had 2 windows desktops go down on the network in the space of one ...
1
vote
1answer
84 views

malware infected server respawing of files [duplicate]

So I have a clients server that is infected with malware. Basically any index.php file on the server was infected as well as header.php, function.php. The infection seems to be primarily wordpress ...
-2
votes
2answers
131 views

Conficker Virus Infection: Where did it start? [closed]

I have a network-wide Conficker infestation, and we have been working on starting virus scans on all our servers and workstations. It is being erased one by one, but I was wondering if there is a ...
4
votes
1answer
169 views

Server Side Virus Scanning

We have basic server-side virus scanning in our datacenter, but it's expensive, uses a considerable amount of CPU cycles, and is annoying to maintain. I'm not looking for a sales-pitch on "better" AV ...
0
votes
1answer
80 views

Small business server 2011 standard - applications randomly closing for remote desktop users

Small business server 2011 standard - applications randomly closing for remote desktop users I have an issue where when you are connected through remote desktop (doesn't matter whether you have ...
0
votes
1answer
258 views

Almost all of our websites within our server is redirecting to a porno scammy sites [duplicate]

We are having a problem within our server. After transferring the files to a new dedicated server, within only one or two weeks almost every website under our server is redirecting to a porno scammy ...
-5
votes
1answer
54 views

Why is the Anti Virus Definition file only 200MBs? [closed]

So I downloaded a virus definition file for symantec endpoint protection. We regularly update our client's closed network anti virus using these files once every 6 months. The files are of '.JDB' ...
1
vote
2answers
45 views

Do these files look like virus remnants?

We've been having Backup Exec issues related to a corrupt file within SYSVOL on an SBS 2008 server. An anti-virus scan removed a file (the same one BE was failing on) from within the scripts folder as ...
0
votes
1answer
202 views

Centos5 /tmp/.xzibit Displays multiple viruses in clamav, Can I delete this directory safely? [duplicate]

Possible Duplicate: How do I deal with a compromised server? I did a scan on my entire vps finding the folder above with a good amount of viruses. Can I safely delete this folder? Can I ...
1
vote
2answers
654 views

How to find any file that is an executable or library

Let's say someone provides you with a tarball, saying it is source code and nothing else. You want to make sure that is true, and that no virus-laden executables or libraries are tucked away in a ...
0
votes
1answer
249 views

Google and Yahoo redirect my site to malware, but direct url works fine. Any computer [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I can go directly to the site doublewing.org or www. without issue, but if I click on the link in google or yahoo it redirects to spam ...
0
votes
1answer
88 views

Our clients site is redirecting to a pill scammy site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We've usually host our clients site, but we aren't hosting this one. The website itself (weddle-funeral.com) works just fine. if ...
1
vote
1answer
2k views

Folders on our server2003-share are being “hidden”, replaced by .exe files

We have had following problem on our Windows2003 server for weeks now, every day the folder on our share are being made hidden and replaced by .exe files with the same names as the original folders. I ...
0
votes
1answer
151 views

What is causing ping sweep?

I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server. The traffic shows sequential pings sent to private ranges only. Eg: 192.168.1.1 192.168.1.2 192.168.1.3 ...
1
vote
1answer
104 views

Hyper-V or VMware - Find all modifications/changes made between 2 Snapshots

I would like to use either Hyper-V or Vmware in order to find out after taking a Clean Base snapshot and a modified snapshot and what the modifications/differences and what was changed between the two ...
0
votes
1answer
547 views

Allowing any file to upload on server and security risks

We are having a project that allows users to backup there data to server through php upload,running on Linux server. If users upload any executable file it will be automatically renamed to some ...
2
votes
1answer
537 views

I have many strange requests in my httpd access_log, does it mean I have a virus?

I have httpd log information as such which goes on and on forever. Firstly, does this mean I have a virus? is my server part of a botnet? My server is Linux Centos 5. tail -f ...
2
votes
4answers
4k views

HP Printer Malfunction (Virus?)

i'm having serious problems with several HP Printers. The issue is the following: my printer (different models) prints random ASCII character on the first line of a paper ( image sample: ...
-3
votes
1answer
149 views

How do I remove a rootkit without an anti-rootkit program? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Windows 2000 Server. I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely ...
-1
votes
1answer
139 views

Virus creates exe files with text content [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Something automatically creates exe files like "zytudou.exe" on my PC with text content: open 122.138.203.175 123 123 get ...
1
vote
3answers
907 views

Recurring virus infection on a domain workstation

One of our users is having a recurring problem with a virus. It has happened to this user on two different machines, in each instance infecting the same program with the same virus. Malware bytes ...
1
vote
3answers
1k views

Scan whole system or just user dirs with clamav

I'm in doubt about how to scan my Linux system with Clamav: do I just scan the places where users can upload files (homedirs, their webroots) or do I scan the whole system? The various sites I've ...
0
votes
1answer
565 views

Critical Virus infection with PHP website. What are the options to remove Virus? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have a critical virus infection to one of my website. There is a additional script found added at footer of few web pages . the ...
0
votes
2answers
876 views

How to remove .htaccess virus [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Subdomain folder with root folder they write a .htaccess file with this code <IfModule mod_rewrite.c> ...
7
votes
3answers
2k views

Can a virus spread through a network share used by an RDP connection?

When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote ...
10
votes
3answers
828 views

Postfix sending and receiving the same e-mail every 5 minutes for 4+ months

Back in June I sent myself the EICAR test signature to make sure my postfix/amavis/spamassassin etc setup was working properly. I didn't notice at the time, but this somehow created a tear in the ...
0
votes
2answers
128 views

Trojan of Web-server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In our web-server most of the sites are infected with this JS-Downloader Trojan. It injected the following code. I've tried to ...
4
votes
2answers
535 views

Possible malware on my server, how to search the source?

Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears. The message is something like "The remote address has ...
2
votes
1answer
7k views

Detecting Torpig on a LAN

I am responsible for the oversight of the LAN at a college campus. Recently we started getting blacklisted by CBL because someone on our LAN is infected with Torpig (AKA Anserin). The suggestion ...
0
votes
2answers
902 views

Strange email coming from/to my computer

I'm running smtp4dev on my machine to trap anything going in/out of my computer on port 25 for testing purposes. Every so often this email gets trapped and I have no idea what it's from. I have ...
2
votes
2answers
1k views

Symantec Endpoint Protection Virus Definitions

I have done some Googling but I cannot get a definitive answer certainly not from the Symantec KB. I have a Virtualised Win 2003R2 server 32bit. It has been provisioned to me with Symantec Endpoint ...
0
votes
2answers
83 views

Host File Redirect From Virus

I have a clients laptop that is doing the redirect of web pages to other sites. I have run HitManPro and Combofix and they didn't come up with anything major. There is no proxy set in Internet ...
0
votes
3answers
107 views

Dedicated Server hit with viruses

Since setting up my dedicated server I have been hit with many viruses. 1 would eat up my bandwidth and another is currently sending out trojans to any outgoing mail from my mail server. Is there a ...
1
vote
0answers
299 views

Scan a NAS Device with Microsoft Forefront Endpoint Protection

We are having problems with viruses sneaking through our virus scanner and onto our NAS and I want to scan the whole NAS. If I attempt to run a scan on the whole drive using the GUI for Forefront ...
0
votes
1answer
171 views

windows xp home security Trojan.FakeAlert - virus/scareware/malware

We have just had our second outbreak of a variant of the Windows XP home security malware (malwarebytes called it Trojan.fakeAlert). It manages to kill our antivirus (nod 32), and then kill attempts ...
1
vote
2answers
276 views

addthis_widget detected as virus

We use sunbelts VIPRE enterprise systems, and I was alerted to almost every computer in the company having this and being quarantined. Is anyone familiar with addthis_widget.js. It detects it as a ...
-1
votes
2answers
136 views

cann anyone solve this questino? [closed]

Routers on the internet never forward packets coming from private IP addresses Explain. Can you see any advantage in this?
0
votes
1answer
678 views

How Can I Disable \PIPE\svcctl in Group Policy?

This is more of a networking question than a programming question. There is a virus running amok on our network at work and it seems to be taking down our servers. I have determined that the virus ...
25
votes
2answers
4k views

Unusual HEAD requests to nonsense URLs from Chrome

I have noticed unusual traffic coming from my workstation the last couple of days. I am seeing HEAD requests sent to random character URLs, usually three or four within a second, and they appear to be ...
2
votes
4answers
652 views

Virus blocking incoming connections?

On my Windows Server 2003 server, all incoming connections are dropped. I can see them getting in using Wireshark, but even a single ping from another computer fails. All locally initiated connection ...
2
votes
3answers
661 views

Force Apache2.2 to drop a request

Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a ...