Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

"Malware" is a portmanteau of "malicious" and "software"

Common forms of malware include:

  • Botnet clients, which grant the malware author some degree of control over the compromised operating system and are generally employed in sending spam e-mail and may be rented out to perform DDoS attacks.
  • Data exfiltrators, which collect and transmit data about the computer they reside on back to the creator. These are commonly used to target login and account details for financial, social networking, and gaming websites.
  • Rogue Utility Applications, which attempt to use scare tactics in order to entice the computer's user to purchase the "full version" of the Rogue Utility.
  • Adware, which causes advertisements to appear on the user's desktop, in webpages, or elsewhere.
  • Rootkits, which attempt to conceal the presence of both the root kit and (usually) an accompanying piece of malware from another category from standard system tools and diagnostic utilities.
333 questions
1
vote
1 answer

How to add wildcards to Linux Malware Detect ignore_paths

I am using Linux Malware Detect to scan and report on malware, but on a daily basis I receive alerts for malware in users emails (mainly spam folder). I do not want alerts for this, the spam folders are cleaned often, and the users may clean it…
Laurence Cope
  • 153
  • 1
  • 7
1
vote
3 answers

Is it normal for port 23 to be connected to periodically?

While working at a customer site (a LAN that includes several Windows machines, plus our server) I noticed that something was periodically attempting to connect to our server on port 23 via TCP. Nobody at that site even knows what telnet is, let…
Jeremy Friesner
  • 1,323
  • 1
  • 14
  • 25
1
vote
2 answers

Unknown issue taking down client machines, virus or coincidence

I’m sorry if this should be on SuperUser instead of ServerFault. Please ask me to migrate the question instead of flaming. I’ve had 2 windows desktops go down on the network in the space of one month, One windows 7 and the other Windows 8 in a…
1
vote
1 answer

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by www-data:www-data and have ug=rwX,o=rX…
Slava Fomin II
  • 1,701
  • 4
  • 17
  • 23
1
vote
1 answer

malware infected server respawing of files

So I have a clients server that is infected with malware. Basically any index.php file on the server was infected as well as header.php, function.php. The infection seems to be primarily wordpress sites although other types of sites reside on the…
MrTechie
  • 119
  • 2
1
vote
1 answer

What are best practices for defense against CryptoLocker type threats in an Active Directory environment?

What are best practices for defense against CryptoLocker type threats in an Active Directory environment? Are there Group Policies that could help? NTFS permissions? Anti-virus software?
Corey
  • 2,031
  • 12
  • 39
  • 54
1
vote
1 answer

False positive rate of CBL

We've come into the office (30+ networked systems) this morning to find that our email server is blacklisted on the CBL for: This IP address is infected with, or is NATting for a machine infected with the ZeroAccess botnet, also known as Sirefef.…
Jamie Taylor
  • 372
  • 1
  • 6
  • 15
1
vote
0 answers

Windows app not allowing debugging

I'll start by saying, I am not sure if this should go in StackOverflow or ServerFault. I posted it in StackOverflow earlier, but its been getting votes to close the question, so I assume it should be going to ServerFault. Here is the link to SO:…
Sugitime
  • 415
  • 1
  • 4
  • 12
1
vote
2 answers

Mac server infected with spam agent

We have a huge trouble :( .. Our mac server makes a spam delivery. Our IP already blacklisted in about a dozen of servers (checked with http://mxtoolbox.com/). We have another computers in the same networks, including PC. What I already did and…
Dmitry
  • 117
  • 7
1
vote
1 answer

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix is reffering me to here, but it's about securing…
Amin Sh
  • 131
  • 1
  • 6
1
vote
3 answers

XP Pro SP3 unresponsive requires power down

New to serverfault, but searched google and the forums here and haven't found anything regarding my issue. I have two laptops in my network that are displaying similar issues. They are from different manufactures so it can't be hardware model…
Bernie
  • 233
  • 2
  • 13
1
vote
2 answers

Do these files look like virus remnants?

We've been having Backup Exec issues related to a corrupt file within SYSVOL on an SBS 2008 server. An anti-virus scan removed a file (the same one BE was failing on) from within the scripts folder as a trojan. The following files are still in the…
1
vote
1 answer

Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role

Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this: The message repeats every second and the port number is increased by one the range of ports being from 1025 to 5000 and then over…
1
vote
2 answers

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of my sites in serving out malware. As a result of…
MrEyes
  • 313
  • 4
  • 14
1
vote
2 answers

How to find any file that is an executable or library

Let's say someone provides you with a tarball, saying it is source code and nothing else. You want to make sure that is true, and that no virus-laden executables or libraries are tucked away in a directory. How to use the find command to do…
Asker
  • 41
  • 1
  • 3