Hot answers tagged

44

This is actually legitimate behaviour. Some ISPs improperly respond to DNS queries to non-existent domains with an A record to a page that they control, usually with advertising, as a "did you mean?" kind of thing, instead of passing NXDOMAIN as the RFC requires. To combat this, Chrome makes several HEAD requests to domains which cannot exist to check how ...


33

You don't "clean malware". You level the machines and start over. Anything less is a disservice to your Customer and asking for trouble. As far as dealing with the "threat", you don't allow users to run with Administrator-level accounts (on Windows), and you don't install untrusted software (inasmuch as is possible). It seems fairly simple to me. My ...


18

If it's a server, it's time to reload. There's no telling what it might have done. sorry.


18

These are my general suggestions for this kind of process. I appreciate you'll have covered some of them already but its better to be told something twice than miss something important. These notes are orientated towards malware that's spreading on a LAN but could easily be scaled back to deal with more minor infections. Stopping the rot, and finding the ...


15

You probably have this burned into your brain forever at this point, but to the benefit of those who come after, Thou Shalt Not Browse the Internet from Thy Server


12

you want Software Restriction Policies. This underutilized feature of modern Windows allows the administrator to allow or restrict executables from running based on the path or even based on a cryptographic signature. By the way, you want more than just EXE's. Software Restriction Policies has a list of 30 or 40 additional types of files that you need to ...


12

It is possible to do that by appending the existing alias onto the malicious one and using cursor movement to hide it if the alias command is used to display alias definitions. It's not a perfectly foolproof method, but it might go undetected for a while. Piping alias through hd will show you whether there are any escape sequences (cursor movement) in your ...


12

Apache has a theory of 'Maximum Clients' That is the number of simultaneous connections it can handle. I.E. if an apache server has a 'max clients' limit of 100, and each request takes 1 second to complete, it can handle a maximum of 100 requests per second. An application like SlowLoris will flood a server with connections, in our example if SlowLoris ...


12

Get the EICAR test vector and use that.


11

The problem is your Amavis setup. Your quarantine destination seems to be a mail address. So Amavis injects the virus mail back into Postfix to be delivered to that address. Postfix now decides to scan the mail first and delegates to Amavis. Amavis recognizes the virus and tries to quarantine it by delivering to the quarantine mail address. So ... You get ...


11

First, if there's a rootkit, you're probably fighting a neverending fight. Take the server offline and reinstall and restore backups that are pre-infection. That's the "best" method of fixing. Second, were you up to date on patches and such before the infection or did you patch after? Third, what custom code is running on the server outside Plesk? How do ...


11

Run Microsoft's Malicious Software Removal tool. It is a stand-alone binary that is useful in the removal of prevalent malicious software, and it can help remove the Win32/Conficker malware family. You can download the MSRT from either of the following Microsoft Web sites: http://www.update.microsoft.com http://support.microsoft.com/kb/890830 Read this ...


11

The reason malware likes to execute from these locations is because legitimate software likes to execute from these locations. They're areas that the user's account should expect to have some level of access to. Based on a quick grep of my own system and a random end-user account on our network: %appdata% Right now, I've got Dropbox, the installer for ...


10

If you suspect a rootkit, don't waste time trying to find it. Wipe and reinstall the system.


9

Normally I'd use Sysinternals tools like tcpview and procmon to see if there were any odd programs or activity on the system. Nothing strange in the logfiles? It's also possible that your network card or network card driver is wonky and may need to be replaced or reinstalled. Is this happening regardless of who's logged in? If the machine is first ...


9

You remove their admin rights. If they don't know what they're doing, they shouldn't have admin rights anyway, and there is no way to stop an administrative (or root) account from doing whatever they want on the machine. That is the nature (and indeed, the point) of root/admin.


9

Have a look at the "Owner" tab under the "Advanced" properties of the "Security" properties page of the file's properties sheet. Odds are good, though, that you're going to see "Administrators" as the owner (which won't be too helpful). The auditing functionality in Windows can help with this kind of thing, but it generates such large volumes of seemingly ...


9

AFAIK, there isn't a package than answers to all your requirements. Best Open Source AV package i know is ClamAV, and it doesn't have much, if any reporting and remote control/installation, and no centralized management. You can circumvent these problems by developing a scripted management and RIS environment. Shouldn't be too hard assuming you already ...


8

Microsoft's Malicious Software Removal Tool is a free tool for Windows XP and Vista (and probably Windows 7) which scans computers and removes specific malicious software. It is automatically updated on the second tuesday of every month via Windows Update. You can find it in the in the 'C:\Windows\System32' folder, its name is mrt.exe. If you don't find ...


8

Are you absolutely certain that you don't want to reinstall that machine? If it were a personal desktop, that would be one thing, but I'm not sure I'd trust a machine without a fresh install. I may be paranoid here, though.


8

Once it's created a process on your server I would consider it as good as hacked. Time to reload or restore. Make sure updates are all setup and lock it down.


8

what about http://www.clamav.net/lang/en/


8

Go to google webmaster tools, put in throttling. Several other spiders respect the Crawl-delay directive in robots.txt, but Googlebot doesn't.


8

This might stop some specific backdoors that only accept POST requests. But it will not stop backdoors in general. A backdoor might accept parameters via GET request, e.g. bad.php?command=somecommand. Or it might execute commands sent via a custom HTTP Header.


7

You can uncompress the file in a safe place (like a filesystem mounted noexec) and check the resulting directories for binaries. The file command can tell you whether a file is text, source code, binary, etc. [root@xt ~]# file ./packages/Digest-MD5-2.33/t/badfile.t ./packages/Digest-MD5-2.33/t/badfile.t: ASCII text [root@xt ~]# file ...


7

Rootkit Revealer does not support and does not run on 64-bit Operating Systems. The fact that Rootkit Revealer fails to run on a windows 7 x64 system tells you nothing. It was never written to support 64 bit and is no longer being developed. Last version was published in 2006-ish? I believe. Notes on the download page state: It runs on Windows XP ...


7

So in this sort of "protected" private datacenter scenario where 95% of the users access the servers from client tools, and there is little to no public exposure, is there a strong case for running A/V clients on all of our back-end servers? Not really, no. Though, it usually boils down to an issue of "compliance" or because someone high enough up ...


7

<blink>Destroy the server and recover from known good backups.</blink>


7

I'd strongly advise to rebuild your server. if the server has been root-compromised how can you assure integrity of all of its parts even if you THINK you've removed the compromised part ? it's easier and saves the time and hassle - rebuild and restore from backups


7

You've done all the things I would do (if I were still a Windows admin) -- The canonical steps are (or were, last time I was a Windows guy): Isolate the affected machines. Update anti-virus definitions Run AV/Malware/etc. scans on the whole network Blow away the affected machines (completely wipe the suckers out) and reinstall. Restore user data from ...



Only top voted, non community-wiki answers of a minimum length are eligible