Tag Info

New answers tagged


Did anyone using your server intentionally send email to ubahreasons@yahoo.com? If so, then this is just a NDR - non-delivery report. If not, then you probably got hacked. /Edit Aha - for some reason I read the lower contents of this email as diagnostic info from your local mailer. Now I see that it is more likely the contents of the unsuccessful email ...


First of all, netstat -ano will show you which ports/IP addresses your computer is connecting to, along with the process ID (PID) of the process which is doing it, eg: TCP ESTABLISHED 6396 TCP ESTABLISHED 6396 TCP ...


This is a difficult question to answer, because there's generally not a single thing that you should do. Rather you collect info from a variety of sources, see what you've got and follow those leads further. Still here's some ideas: significant info I see in what you've given us includes: a cron job has been installed, and you know some times when it ...


A PHP file on the server could have a vulnerability written into the code. One such example would be code that takes user input and does not do any sort of validation checking of the input. There are bots typically used to find this type of code and validates that it can exploit it. The virus will then replicate itself to every PHP file that is can find. ...


The only thing that can reasonably be inferred from the fact that files were modified in a directory where no FTP access is allowed, is that they were not modified using FTP. Which means something else in the server has been compromised other than FTP. Which means you should be even more eager to nuke it ASAP.


Given that there is potentially root-level malware on the loose, grab a known-good laptop (e.g. one booted from a LiveCD) and plug it into a port on the switch. Fire up some packet capturing software. Unplug cables (optionally in small groups) until the traffic of interest stops. Identify the device(s) connected to the cable(s) in question. Note that, in ...


Run a packet capture. Look at the ARP request in the capture. Identify the source MAC address in the ARP request. Look for the switch port tied to that that MAC address in the MAC address table of the switch. Identify the device connected to that switch port. Inspect that device.

Top 50 recent answers are included