Questions tagged [malware]
Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
338
questions
1
vote
2
answers
420
views
One machine blocked from a single server, and only when it's at this physical location?
I host an e-commerce website for a client who suddenly is unable to access it from his computer. He can ping the server, he can SSH in, but cannot load the website in any browser we've tried: IE, ...
- 513
0
votes
2
answers
117
views
strange tcp network connections 149.9.1.16:ircd [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
I am seeing strange tcp connection 149.9.1.16:ircd ans it is running perl service
and that process is creating huge load on server
IPV4 ...
- 1
0
votes
1
answer
101
views
Good resource for evaluting AV and anti Malware software?
I am looking for good resources to use to compare the effectiveness of various antivirus/antimalware software solutions. In particular, I am comparing Windows Security Essentials against Symantec ...
- 1,079
-1
votes
1
answer
295
views
.htaccess malware detected - where to report? [closed]
just detected some .htaccess malware on one of my servers (shared hosting). The provider (1and1) doesn't seem to care (we take a look into this on monday).
Is there any good place to report this ...
- 117
0
votes
1
answer
1k
views
Critical Virus infection with PHP website. What are the options to remove Virus? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
I have a critical virus infection to one of my website.
There is a additional script found added at footer of few web pages . the pages ...
- 101
0
votes
2
answers
2k
views
How to remove .htaccess virus [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
All Subdomain folder with root folder they write a .htaccess file with this code
<IfModule mod_rewrite.c> ...
user619018
2
votes
3
answers
7k
views
Linux Stealth Process
I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...
...
- 324
13
votes
4
answers
2k
views
How do I deal with the removal/eradication of an unknown worm on our network?
TL;DR
I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
- 451
1
vote
4
answers
175
views
sendmail sending mail to recipients I don’t know of; possible spam host
Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday.
STATISTICS
----------
Messages To Recipients: 582
Addressed Recipients: ...
- 4,443
2
votes
3
answers
775
views
Do we need both Eset and SuperAntiSpyware?
Our company had a bad virus experience several years ago. Probably as a result, every pc has Eset Nod & SuperAntiSpyware installed.
I think this is excessive and that Eset should allow sufficient ...
- 597
7
votes
3
answers
5k
views
Can a virus spread through a network share used by an RDP connection?
When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote server),...
- 881
13
votes
3
answers
2k
views
Postfix sending and receiving the same e-mail every 5 minutes for 4+ months
Back in June I sent myself the EICAR test signature to make sure my postfix/amavis/spamassassin etc setup was working properly. I didn't notice at the time, but this somehow created a tear in the ...
- 181
-1
votes
1
answer
47
views
How can I uninstall Antivirus Studio 2010 completely? [closed]
Is Antivirus Studio 2010 malware? I found it installed on my computer yesterday, and I try to uninstall it with Control Panel. But I noticed that it is still running! How can I uninstall it completely?...
- 1
1
vote
2
answers
232
views
Amazon EC2 Morto worm and Windows RDP
We run an Amazon EC2 Windows instance and recently received an email from Amazon warning us that RDP is open to everybody and there is a new threat in the wild that may exploit this.
The security ...
- 135
0
votes
2
answers
170
views
Trojan of Web-server [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
In our web-server most of the sites are infected with this JS-Downloader Trojan. It injected the following code. I've tried to clean up ...
- 177
-2
votes
2
answers
176
views
Good malware removal tool(s) for windows XP/Vista/7? [closed]
The goal for this Wiki is to extablish a list of known good tools for cleaning up those pesky malware / virues that haunt windows clients. What tools do you like and what are their strengths and ...
- 856
4
votes
2
answers
847
views
Possible malware on my server, how to search the source?
Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears.
The message is something like
"The remote address has ...
- 1,362
3
votes
1
answer
3k
views
Cisco reputation filters mis-identified site as malware or "misconfigured DNS"
A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
- 131
2
votes
1
answer
8k
views
Detecting Torpig on a LAN
I am responsible for the oversight of the LAN at a college campus. Recently we started getting blacklisted by CBL because someone on our LAN is infected with Torpig (AKA Anserin). The suggestion ...
- 203
0
votes
1
answer
152
views
Security & Malware Protection for Windows 2008 Server (with RDP)
I am running an ASP.NET site on a windows 2008 server with RDP access to the server. Installing or enabling firewalls shuts off my RDP access and multiple other issues. My hosting provider is very ...
- 101
1
vote
1
answer
697
views
Restrict number of parallel connections on Apache server
I'm on an Ubuntu server running Apache2. I would like to protect myself against (d)dos and syn flood attacks and therefore try to limit the number of parallel connections per client IP.
I've heard ...
- 249
1
vote
1
answer
760
views
How can I limit Googlebot's crawl rate?
I have a problem with one of my servers. Google opens lots of http connections to the apache server and basically performs a slowloris attack.
This netstat call results in the following output
...
- 165
3
votes
3
answers
172
views
Training High School Students on Security - What harmless "viruses" can I install that they can find? [closed]
I'm training some high school students interested in OS security (specifically, Windows Server 2003/2008), and though I've gone over a lot of the "in-theory" stuff, some hands on would be great. They'...
- 2,817
0
votes
2
answers
1k
views
Strange email coming from/to my computer
I'm running smtp4dev on my machine to trap anything going in/out of my computer on port 25 for testing purposes. Every so often this email gets trapped and I have no idea what it's from. I have ...
- 344
2
votes
2
answers
3k
views
Symantec Endpoint Protection Virus Definitions
I have done some Googling but I cannot get a definitive answer certainly not from the Symantec KB.
I have a Virtualised Win 2003R2 server 32bit.
It has been provisioned to me with Symantec Endpoint ...
- 21
0
votes
2
answers
94
views
Host File Redirect From Virus
I have a clients laptop that is doing the redirect of web pages to other sites.
I have run HitManPro and Combofix and they didn't come up with anything major. There is no proxy set in Internet ...
- 579
27
votes
3
answers
15k
views
Why are NginX and Lighttpd not affected by Slowloris?
I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works.
What I don't understand is why Lighttpd and NginX are not affected (according to the ...
- 2,240
0
votes
3
answers
157
views
Dedicated Server hit with viruses
Since setting up my dedicated server I have been hit with many viruses. 1 would eat up my bandwidth and another is currently sending out trojans to any outgoing mail from my mail server.
Is there a ...
- 3
1
vote
0
answers
405
views
Scan a NAS Device with Microsoft Forefront Endpoint Protection
We are having problems with viruses sneaking through our virus scanner and onto our NAS and I want to scan the whole NAS. If I attempt to run a scan on the whole drive using the GUI for Forefront ...
- 1,670
0
votes
1
answer
197
views
windows xp home security Trojan.FakeAlert - virus/scareware/malware
We have just had our second outbreak of a variant of the Windows XP home security malware (malwarebytes called it Trojan.fakeAlert). It manages to kill our antivirus (nod 32), and then kill attempts ...
- 143
0
votes
3
answers
104
views
Problem for my website, Some attack pages intentionally distribute harmful software [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
Some pages of my website are distributing harmful software. How do I investigate and fix this?
- 167
1
vote
2
answers
1k
views
addthis_widget detected as virus
We use sunbelts VIPRE enterprise systems, and I was alerted to almost every computer in the company having this and being quarantined.
Is anyone familiar with addthis_widget.js. It detects it as a ...
- 1,089
0
votes
4
answers
2k
views
Portable Malware Scanning Software for Win2008
Is there any malware/spyware/virus scanning software that can be run via USB or other means to scan a windows server 2008? It needs to be something that does not need to be installed.
- 506
7
votes
5
answers
360
views
Kids + older computers + our network at the office: Security risk?
On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the brats^H^H^...
- 283
4
votes
3
answers
2k
views
Debian webserver malware scanner
I was wondering if there was a malware scanner for websites with up to date exploits for use on a Debian webs server with Apache2.2?
Vulnerability scanners are great, but I also want to be sure that ...
- 539
-1
votes
2
answers
146
views
cann anyone solve this questino? [closed]
Routers on the internet never forward packets coming from private IP addresses Explain. Can you see any advantage in this?
- 1
1
vote
1
answer
59
views
Administering forums on servers, seeing weird attacks
I'm not sure ServerFault is the correct place for such a question: please redirect if another StackExchange site is more appropriate but I think this is the "most correct" one.
On one of the server I'...
- 205
0
votes
1
answer
154
views
Server redirect malware [duplicate]
I have a linux packaged server (is that right?) that I run for a coworker. It has recently been hacked and I've been trying for the last few days to get rid of the malware. It now redirects most of my ...
0
votes
1
answer
2k
views
How Can I Disable \PIPE\svcctl in Group Policy?
This is more of a networking question than a programming question. There is a virus running amok on our network at work and it seems to be taking down our servers. I have determined that the virus ...
- 111
2
votes
3
answers
128
views
Avoiding viruses 101 [closed]
I'm looking to send out an email to my users to give them advice on avoiding getting viruses and phishing emails.
I've found http://www.sonicwall.com/furl/phishing/ which is a bit dated and is ...
- 1,041
62
votes
3
answers
16k
views
Unusual HEAD requests to nonsense URLs from Chrome
I have noticed unusual traffic coming from my workstation the last couple of days. I am seeing HEAD requests sent to random character URLs, usually three or four within a second, and they appear to be ...
- 893
2
votes
4
answers
1k
views
Virus blocking incoming connections?
On my Windows Server 2003 server, all incoming connections are dropped. I can see them getting in using Wireshark, but even a single ping from another computer fails.
All locally initiated connection ...
- 1,351
2
votes
3
answers
1k
views
Force Apache2.2 to drop a request
Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a ...
- 323
2
votes
3
answers
367
views
What would you do when a worm infects everything?
Ive always wondered, what can we do if a virus or worm happens to affect the main file server?
What if from the file server the clients get infected by said worm/virus?
How would you clean it up? ...
- 295
0
votes
1
answer
380
views
Possible causes for Domain server being unavailable? [duplicate]
Possible Duplicate:
Reinstall after a Root Compromise?
One of our servers was compromised after a user with administrative privileges accidentally loaded a virus from a USB drive on a desktop ...
- 195
0
votes
3
answers
165
views
What options do I have for virus protection on windows server 2008 (this server is not a mail server)?
I would like to use some kind of virus protection on the server. What options do I have? I installed MS security essentials, but I just learned that I is not for commercial/government use.
- 333
0
votes
3
answers
280
views
DirectAdmin Centos4 server has virus [duplicate]
I have a problem with a webserver that runs Centos4 with DirectAdmin.
Since a few weeks some websites hosted on it are not redirecting on search engines properly, they are redirected to some malware ...
- 340
0
votes
1
answer
909
views
vi.recover/update command appears every minute in cron log. (POSSIBLE VIRUS)
UPDATE (7th Dec 2010) & WARNING: I copied the files discussed below (from the /var/tmp/vi.recover directory) to my Windows PC and sacnned with ESET NOD 32. It identifed two of the file (sshd: and ...
- 219
0
votes
2
answers
502
views
Removing VirTool:Win32/VBInject.gen!DG
i get this little bugger poping up every start up, my microsoft security essentials stops initial attempt and there no threat till next start up. I was wondering, if there any tools to check and ...
user51768
1
vote
2
answers
176
views
Search result redirect virus
I'm stumped. I'm up against a virus on a desktop PC that has hijcaked all search results (Google, Yahoo!, Bing, etc.) in both IE and Firefox, and it happens to both accounts that log into the machine,...
- 142