Hot answers tagged

109

The only way to be absolutely certain is to wipe every system clean and to reinstall from scratch. You will also need to audit all of the locally generated software and configurations to ensure that they do not contain backdoors. This is a non trivial task which comes with a non trivial cost. Beyond that then there isn't really much you can do. Obviously ...


85

If they are indeed zipped Windows exe files, they should be harmless to your Linux system, unless you have something like Wine in place that could try to execute them. But if they are in your web path, they could be malware and pose a big risk for your web sites' visitors (and you in turn, if you end up being marked as malware source and users get ugly ...


62

Since I'm able to uncompress the files on my mac I assume these are real zip files and not just something like renamed php files. While you're probably right in this case, your assumption might not always hold. A ZIP archive remains valid even if you prepend arbitrary data to it, so it's quite possible to create a file that is simultaneously a valid ZIP ...


40

First, the most important goal of a fired sysadmin is to clean up his past, particularly if it was a departure in bad standing. If an attack on his previous system were to happen he wouldn't stand to gain anything (particularly not his old job), but he could lose a lot. I've been faced with similar fears many times, but in my opinion, they are largely ...


25

Apache has a theory of 'Maximum Clients' That is the number of simultaneous connections it can handle. I.E. if an apache server has a 'max clients' limit of 100, and each request takes 1 second to complete, it can handle a maximum of 100 requests per second. An application like SlowLoris will flood a server with connections, in our example if SlowLoris ...


18

These are my general suggestions for this kind of process. I appreciate you'll have covered some of them already but its better to be told something twice than miss something important. These notes are orientated towards malware that's spreading on a LAN but could easily be scaled back to deal with more minor infections. Stopping the rot, and finding the ...


16

Did you try uploading the file to virustotal.com for a broader scan? But in general I agree with Gerald Schneider. Take the server off the network, restore it and check other Servers / Clients for suspicious files / processes and activities.


15

@JonasWielicki compared this question to one of our canonical security questions (How do I deal with a Compromised Server). I stand by my answer to that question but there's an important difference. In that question the server was known to be compromised. As far as I understand this question that hasn't been established in this case. As such, I'm not sure ...


13

Nginx is actually vulnerable to slowloris attack. Scarce resource is the maximum number of simultaneous worker connections. This number can be calculated as worker_connections * worker_processes and equals to 512 in default nginx configuration. So, it is quite easy to take down unprotected nginx with tools such as goloris.


12

The problem is your Amavis setup. Your quarantine destination seems to be a mail address. So Amavis injects the virus mail back into Postfix to be delivered to that address. Postfix now decides to scan the mail first and delegates to Amavis. Amavis recognizes the virus and tries to quarantine it by delivering to the quarantine mail address. So ... You get ...


12

The reason malware likes to execute from these locations is because legitimate software likes to execute from these locations. They're areas that the user's account should expect to have some level of access to. Based on a quick grep of my own system and a random end-user account on our network: %appdata% Right now, I've got Dropbox, the installer for ...


12

The only way to ensure that no backdoor exist for sure is nuking the system like you said. If that isn't entirely possible, Consider a baseline secure configuration and analyse of the current configuration is deviant from that. Verify all the suid programs. Analyse all the running processes. Perform a portscan on the system to identify open ports and ...


12

Sure. You'll probably want to do something more useful than the following example though. $evilHashes = @( '4C51A173404C35B2E95E47F94C638D2D001219A0CE3D1583893E3DE3AFFDAFE0', 'CA1DEE12FB9E7D1B6F4CC6F09137CE788158BCFBB60DED956D9CC081BE3E18B1' ) Get-ChildItem -Recurse -Path C:\somepath | Get-FileHash | Where-Object { $_.Hash -in $...


11

First, if there's a rootkit, you're probably fighting a neverending fight. Take the server offline and reinstall and restore backups that are pre-infection. That's the "best" method of fixing. Second, were you up to date on patches and such before the infection or did you patch after? Third, what custom code is running on the server outside Plesk? How do ...


10

If you suspect a rootkit, don't waste time trying to find it. Wipe and reinstall the system.


10

You're going to need to decide how sure you want to be. The cost-benefit is never going to pan out for nuking from orbit. Are managers demanding assurances or are you just trying to do some reasonable examination of the systems you've inherited? If it's managers, now you get to find out how reasonable they are. Are they willing to settle for "pretty ...


9

Normally I'd use Sysinternals tools like tcpview and procmon to see if there were any odd programs or activity on the system. Nothing strange in the logfiles? It's also possible that your network card or network card driver is wonky and may need to be replaced or reinstalled. Is this happening regardless of who's logged in? If the machine is first ...


9

You remove their admin rights. If they don't know what they're doing, they shouldn't have admin rights anyway, and there is no way to stop an administrative (or root) account from doing whatever they want on the machine. That is the nature (and indeed, the point) of root/admin.


9

[String]$BadHash = '5073D1CF59126966F4B0D2B1BEA3BEB5' Foreach ($File In Get-ChildItem C:\ -file -recurse) { If ((Get-FileHash $File.Fullname -Algorithm MD5).Hash -EQ $BadHash) { Write-Warning "Oh no, bad file detected: $($File.Fullname)" } }


9

If you have a copy of the file, you should activate AppLocker across the entire domain and add a hash rule for that file to stop its execution. This has the added bonus of identifying computers that are trying to run the program because AppLocker logs block and deny actions by default.


8

Go to google webmaster tools, put in throttling. Several other spiders respect the Crawl-delay directive in robots.txt, but Googlebot doesn't.


8

valyala's comment should be accepted as the answer. Most nginx servers use default configs and therefore vulnerable to slowloris attack. I have used slowloris to take down some of my friend's nginx websites using only my laptop and usually it took less than 5 minutes (my friends challenged me to do so). As valyala stated, technically, nginx is not ...


8

You can uncompress the file in a safe place (like a filesystem mounted noexec) and check the resulting directories for binaries. The file command can tell you whether a file is text, source code, binary, etc. [root@xt ~]# file ./packages/Digest-MD5-2.33/t/badfile.t ./packages/Digest-MD5-2.33/t/badfile.t: ASCII text [root@xt ~]# file ./packages/Digest-MD5-...


8

Rootkit Revealer does not support and does not run on 64-bit Operating Systems. The fact that Rootkit Revealer fails to run on a windows 7 x64 system tells you nothing. It was never written to support 64 bit and is no longer being developed. Last version was published in 2006-ish? I believe. Notes on the download page state: It runs on Windows XP (32-...


8

<blink>Destroy the server and recover from known good backups.</blink>


8

This might stop some specific backdoors that only accept POST requests. But it will not stop backdoors in general. A backdoor might accept parameters via GET request, e.g. bad.php?command=somecommand. Or it might execute commands sent via a custom HTTP Header.


8

In general any ransomware can encrypt anything the infected user has access to, like any other malware can write to anywhere using the permissions of the account running it. That doesn't equal it becoming active for other users, but it can affect all shares the user has access to. Countermeasures: Prevent with virus protection & firewall, as usual. ...


7

You've done all the things I would do (if I were still a Windows admin) -- The canonical steps are (or were, last time I was a Windows guy): Isolate the affected machines. Update anti-virus definitions Run AV/Malware/etc. scans on the whole network Blow away the affected machines (completely wipe the suckers out) and reinstall. Restore user data from ...


7

I'd strongly advise to rebuild your server. if the server has been root-compromised how can you assure integrity of all of its parts even if you THINK you've removed the compromised part ? it's easier and saves the time and hassle - rebuild and restore from backups


Only top voted, non community-wiki answers of a minimum length are eligible