Tag Info

Hot answers tagged

41

This is actually legitimate behaviour. Some ISPs improperly respond to DNS queries to non-existent domains with an A record to a page that they control, usually with advertising, as a "did you mean?" kind of thing, instead of passing NXDOMAIN as the RFC requires. To combat this, Chrome makes several HEAD requests to domains which cannot exist to check how ...


33

You don't "clean malware". You level the machines and start over. Anything less is a disservice to your Customer and asking for trouble. As far as dealing with the "threat", you don't allow users to run with Administrator-level accounts (on Windows), and you don't install untrusted software (inasmuch as is possible). It seems fairly simple to me. My ...


18

If it's a server, it's time to reload. There's no telling what it might have done. sorry.


18

These are my general suggestions for this kind of process. I appreciate you'll have covered some of them already but its better to be told something twice than miss something important. These notes are orientated towards malware that's spreading on a LAN but could easily be scaled back to deal with more minor infections. Stopping the rot, and finding the ...


15

You probably have this burned into your brain forever at this point, but to the benefit of those who come after, Thou Shalt Not Browse the Internet from Thy Server


12

you want Software Restriction Policies. This underutilized feature of modern Windows allows the administrator to allow or restrict executables from running based on the path or even based on a cryptographic signature. By the way, you want more than just EXE's. Software Restriction Policies has a list of 30 or 40 additional types of files that you need to ...


12

It is possible to do that by appending the existing alias onto the malicious one and using cursor movement to hide it if the alias command is used to display alias definitions. It's not a perfectly foolproof method, but it might go undetected for a while. Piping alias through hd will show you whether there are any escape sequences (cursor movement) in your ...


12

Get the EICAR test vector and use that.


11

First, if there's a rootkit, you're probably fighting a neverending fight. Take the server offline and reinstall and restore backups that are pre-infection. That's the "best" method of fixing. Second, were you up to date on patches and such before the infection or did you patch after? Third, what custom code is running on the server outside Plesk? How do ...


11

The problem is your Amavis setup. Your quarantine destination seems to be a mail address. So Amavis injects the virus mail back into Postfix to be delivered to that address. Postfix now decides to scan the mail first and delegates to Amavis. Amavis recognizes the virus and tries to quarantine it by delivering to the quarantine mail address. So ... You get ...


11

Run Microsoft's Malicious Software Removal tool. It is a stand-alone binary that is useful in the removal of prevalent malicious software, and it can help remove the Win32/Conficker malware family. You can download the MSRT from either of the following Microsoft Web sites: http://www.update.microsoft.com http://support.microsoft.com/kb/890830 Read this ...


10

Apache has a theory of 'Maximum Clients' That is the number of simultaneous connections it can handle. I.E. if an apache server has a 'max clients' limit of 100, and each request takes 1 second to complete, it can handle a maximum of 100 requests per second. An application like SlowLoris will flood a server with connections, in our example if SlowLoris ...


10

The reason malware likes to execute from these locations is because legitimate software likes to execute from these locations. They're areas that the user's account should expect to have some level of access to. Based on a quick grep of my own system and a random end-user account on our network: %appdata% Right now, I've got Dropbox, the installer for ...


9

If you suspect a rootkit, don't waste time trying to find it. Wipe and reinstall the system.


9

Normally I'd use Sysinternals tools like tcpview and procmon to see if there were any odd programs or activity on the system. Nothing strange in the logfiles? It's also possible that your network card or network card driver is wonky and may need to be replaced or reinstalled. Is this happening regardless of who's logged in? If the machine is first ...


9

You remove their admin rights. If they don't know what they're doing, they shouldn't have admin rights anyway, and there is no way to stop an administrative (or root) account from doing whatever they want on the machine. That is the nature (and indeed, the point) of root/admin.


9

Have a look at the "Owner" tab under the "Advanced" properties of the "Security" properties page of the file's properties sheet. Odds are good, though, that you're going to see "Administrators" as the owner (which won't be too helpful). The auditing functionality in Windows can help with this kind of thing, but it generates such large volumes of seemingly ...


9

AFAIK, there isn't a package than answers to all your requirements. Best Open Source AV package i know is ClamAV, and it doesn't have much, if any reporting and remote control/installation, and no centralized management. You can circumvent these problems by developing a scripted management and RIS environment. Shouldn't be too hard assuming you already ...


8

Microsoft's Malicious Software Removal Tool is a free tool for Windows XP and Vista (and probably Windows 7) which scans computers and removes specific malicious software. It is automatically updated on the second tuesday of every month via Windows Update. You can find it in the in the 'C:\Windows\System32' folder, its name is mrt.exe. If you don't find ...


8

Are you absolutely certain that you don't want to reinstall that machine? If it were a personal desktop, that would be one thing, but I'm not sure I'd trust a machine without a fresh install. I may be paranoid here, though.


8

Once it's created a process on your server I would consider it as good as hacked. Time to reload or restore. Make sure updates are all setup and lock it down.


8

what about http://www.clamav.net/lang/en/


8

Go to google webmaster tools, put in throttling. Several other spiders respect the Crawl-delay directive in robots.txt, but Googlebot doesn't.


7

I'd strongly advise to rebuild your server. if the server has been root-compromised how can you assure integrity of all of its parts even if you THINK you've removed the compromised part ? it's easier and saves the time and hassle - rebuild and restore from backups


7

You've done all the things I would do (if I were still a Windows admin) -- The canonical steps are (or were, last time I was a Windows guy): Isolate the affected machines. Update anti-virus definitions Run AV/Malware/etc. scans on the whole network Blow away the affected machines (completely wipe the suckers out) and reinstall. Restore user data from ...


7

We were happy users of Symantec Anti Virus Corp for years, that is until Endpoint Protection came along. Slowed our computers down so that they were largely unusable. These were computers that ran SAV just fine. So about a year ago, we migrated our machines to ESET and their NOD32 product. While the management console can be kind of daunting, we've been ...


7

Use OpenDNS Low filtering and tell them that you are securing the company against malware, phishing, etc. You can put in legitimate exceptions by "Manag[ing] individual domains". They're not going to come to you to except porn sites, now are they? ;-) Cheers


7

You say: "It appears this porn surfing has lead to virus infections on their computers despite the presence of an anti-virus.". I see too many answers focusing on the porn aspect of the issue. One might land on a porn type "trap site" even when searching for something as innocent as a cookie recipe or pcitures of the latest Corvette model. Since you are ...


7

You can uncompress the file in a safe place (like a filesystem mounted noexec) and check the resulting directories for binaries. The file command can tell you whether a file is text, source code, binary, etc. [root@xt ~]# file ./packages/Digest-MD5-2.33/t/badfile.t ./packages/Digest-MD5-2.33/t/badfile.t: ASCII text [root@xt ~]# file ...


7

So in this sort of "protected" private datacenter scenario where 95% of the users access the servers from client tools, and there is little to no public exposure, is there a strong case for running A/V clients on all of our back-end servers? Not really, no. Though, it usually boils down to an issue of "compliance" or because someone high enough up ...



Only top voted, non community-wiki answers of a minimum length are eligible