My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS.   Anyone knows what this malware does exactly ? What are the chances that this is a false alarm? Can I install any easy-to-use tool that can safely scan my system from SSH without breaking any system files ?      In the last 24 hours, Symantec analysts have identified malware   configured to communicate with resources on your network. The malware   and your related resources are listed below.      MD5     Detection       ASN     Description   b83ff89585d668c3ca96b34b44da4093        Backdoor.Graybird!Gen   16265    www.dymll.com, 82.192.XXX.XXX, 82.192.XXX.0/19, ripencc, NL, FIBERRING   LeaseWeb B.V.,NL      Please use this information to investigate the potential abuse of your   network, and take corrective actions based on your own internal   procedures.
281
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
35833
I'm running an SSH server on my personal computer. The log had many people(or bots?) repeatedly trying to log in to my server (that is before I changed the default port), which made me a little freaked out. I was worried about their dictionary attacks or brute force password guessing.  But then if you type wrong password (or wrong username), the server waits for about 2 seconds before it asks for password again. So an attacker can try one password per 2 seconds. So I concluded that these attacks aren't that great a threat (as long as your password does not consist of dictionary words.) Am I correct?
14567
I just got this error message for the first time (I was getting this as the response to any request on the SE network for about the last five minutes, until now):     We're sorry...      There are an unusual number of requests coming from this IP address.   To protect our users, we can't process any more requests from this IP   address right now. We'll restore access as quickly as possible, so try   again soon. If you believe you have reached this page in error,   contact us.   As far as I know, I was not spamming SE or participating in DOS attack, and I find it unlikely that any of my office coworkers who share my IP address were doing so either.  Granted, I was pressing F5 a lot. But I've always pressed F5 a lot on SE, and have never gotten this message before. So my question is: Is it possible to get this error message simply by refreshing too much or too often? Or is that message reserved for a truly massive number of requests that are unlikely to be caused by one person refreshing a lot? (In the former case, I can't explain why I've never gotten it before; in the latter case, I can't explain why I just got it now).
17746
I'm at a library, and all of the computers are Windows based.  I'm sshing into my Ubuntu box somewhere else. The terms of service says "You may not make any changes to system files." However, when I ssh into my Ubuntu box, it might "look" like I'm hacking, since I've had a few people (including I presume the library supervisor) look at my computer funny when I opened a website where the text was a monospaced font and the website background was black. Running Command Prompt will certainly be considered to be hacking if looking at a website was.  If I'm sshing into my box it appears as though I'm "hacking" into the computer. I'd like to somehow do it in a web browser with nice happy looking text, so that it actually represents what I'm doing; I'm not going to hack into the computer, I'm only using a computer somewhere else.
38744
An interesting question.  I have logged into a Linux (most likely SuSE) host.  Is there some way that I can tell programmatically that I am a VM host or not?    Also assume that the vmtools are not installed.
55986
When I boot up my PC, I get these windows security alert message telling me to allow the programs and I have configured to open on startup through the firewall, then if I open an application E.G Steam, it gives me the same message, so I press allow, but the next time I boot the application or PC, they show up again, I've done a virus scan with Malwarebytes to no avail. I am using windows 10    Thanks in advance
22699
This morning, running top, I noticed a process I nave never seen before in my Ubuntu 18.04 laptop called MainThread, which was periodically using a lot of CPU . There was also an entry called Privileged Cont. I recently installed nordvpn, but nordvpn support said the process is not theirs. Is this a new part of the operating system? Is it malware? It has never appeared in top on my laptop before, as far as I know.
82372
After the  and , now I've heard about a new vulnerability in SSL/TLS called . How do I protect myself against being exploited?   Are only servers or also clients affected? Is this OpenSSL/GnuTLS specific? What kind of services are affected? Only HTTPS or also IMAPS, SMTPS, OpenVPN, etc.?   Please show me examples on how to avoid this vulnerability.
90246
My server rebooted and I am not sure why.  Is there a way to find out, e.g. perhaps someone did it manually, or as a result of a windows update or a blue screen?  I've looked in the Event Viewer, but I am not sure what to look for - there are million items there.
4957
I thought that there was no need to scan for viruses either in Ubuntu or any Linux distros until I found virus scanner packages clamtk and klamav in Ubuntu software center yesterday.  This leads to the following questions:   How do viruses differ between Linux and Windows? How do the strategies for protection differ between Linux and Windows? Should a virus scanner package be installed on my system? If so, which would be a better option?
53247
Every time I click to open a link, other windows start opening. They all want to sell me Detox your Mac or have warnings about how my Mac is at risk or infected.  How can I check for malware?
22185
I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm starting to worry since they are getting more common (last month I got 2 attacks, and on november 7th there are 3 attempts already (1st, 4th and 6th of nov).  I'm not really concerned about it, since I don't have any database. All the info i have on that server is absolutely public, but I'm worried about that attacking-rate increase.  So I thought I could -temporarily- block the IPs that come from those attackers, or something that could make my server ignore requests that ask for phpMyAdmin, pma, xamp, etc.  Is there something like that? my server is Linux+Apache+Php
109178
Is there a way to know who is pinging my PC on my network? Is it possible to monitor all ICMP packets? How can I do that?
4716
[root@datacenteronline ~]# ssh root@192.168.1.172 Last login: Wed Apr 17 09:55:45 2013 from 192.168.1.187 [root@localhost ~]# ls /proc/ | grep 2266 [root@localhost ~]# cd /proc/2266 [root@localhost 2266]# ls attr             cpuset   limits      net            root       statm autogroup        cwd      loginuid    numa_maps      sched      status auxv             environ  maps        oom_adj        schedstat  syscall cgroup           exe      mem         oom_score      sessionid  task clear_refs       fd       mountinfo   oom_score_adj  smaps      wchan cmdline          fdinfo   mounts      pagemap        stack coredump_filter  io       mountstats  personality    stat [root@localhost 2266]# ls -al /proc/2266 total 0 dr-xr-xr-x   7 apache apache 0 Apr 17 09:45 . dr-xr-xr-x 266 root   root   0 Apr 17 09:11 .. dr-xr-xr-x   2 apache apache 0 Apr 17 09:45 attr -rw-r--r--   1 root   root   0 Apr 17 09:45 autogroup -r--------   1 root   root   0 Apr 17 09:45 auxv -r--r--r--   1 root   root   0 Apr 17 09:45 cgroup --w-------   1 root   root   0 Apr 17 09:45 clear_refs -r--r--r--   1 root   root   0 Apr 17 09:45 cmdline -rw-r--r--   1 root   root   0 Apr 17 09:45 coredump_filter -r--r--r--   1 root   root   0 Apr 17 09:45 cpuset lrwxrwxrwx   1 root   root   0 Apr 17 09:45 cwd -&gt; / -r--------   1 root   root   0 Apr 17 09:45 environ lrwxrwxrwx   1 root   root   0 Apr 17 09:45 exe -&gt; /usr/local/apache2/bin/httpd dr-x------   2 root   root   0 Apr 17 09:45 fd dr-x------   2 root   root   0 Apr 17 09:45 fdinfo -r--------   1 root   root   0 Apr 17 09:45 io -rw-------   1 root   root   0 Apr 17 09:45 limits -rw-r--r--   1 root   root   0 Apr 17 09:45 loginuid -r--r--r--   1 root   root   0 Apr 17 09:45 maps -rw-------   1 root   root   0 Apr 17 09:45 mem -r--r--r--   1 root   root   0 Apr 17 09:45 mountinfo -r--r--r--   1 root   root   0 Apr 17 09:45 mounts -r--------   1 root   root   0 Apr 17 09:45 mountstats dr-xr-xr-x   6 apache apache 0 Apr 17 09:45 net -r--r--r--   1 root   root   0 Apr 17 09:45 numa_maps -rw-r--r--   1 root   root   0 Apr 17 09:45 oom_adj -r--r--r--   1 root   root   0 Apr 17 09:45 oom_score -rw-r--r--   1 root   root   0 Apr 17 09:45 oom_score_adj -r--r--r--   1 root   root   0 Apr 17 09:45 pagemap -r--r--r--   1 root   root   0 Apr 17 09:45 personality lrwxrwxrwx   1 root   root   0 Apr 17 09:45 root -&gt; / -rw-r--r--   1 root   root   0 Apr 17 09:45 sched -r--r--r--   1 root   root   0 Apr 17 09:45 schedstat -r--r--r--   1 root   root   0 Apr 17 09:45 sessionid -r--r--r--   1 root   root   0 Apr 17 09:45 smaps -r--r--r--   1 root   root   0 Apr 17 09:45 stack -r--r--r--   1 root   root   0 Apr 17 09:45 stat -r--r--r--   1 root   root   0 Apr 17 09:45 statm -r--r--r--   1 root   root   0 Apr 17 09:45 status -r--r--r--   1 root   root   0 Apr 17 09:45 syscall dr-xr-xr-x  29 apache apache 0 Apr 17 09:45 task -r--r--r--   1 root   root   0 Apr 17 09:45 wchan   Cound anyone tell me what it is?
93332
I regularly ssh to a centos 5 box. Somehow they keys are mapped so that control+d will log me out of my current shell. If I am sudo'ed to another use it puts me back to the previous user. If I am not sudo'ed it just disconnects me. How can I keep this from happening? I regularly use control+d to cancel out of the python interpreter and sometimes I accidentally press it more than once.
35897
What's the best approach towards determining if I have a rogue DHCP server inside my network?  I'm wondering how most admins approach these kinds of problems.  I found  through searching, and thought about trying it out.  Has anyone had experience with it? (I would like to know before taking the time to compile it and install).  Do you know any useful tools or best-practices towards finding rogue DHCP servers?
769
Is there a way to avoid ssh printing warning messages like this?   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@   Although the remote host identity has changed but I know it is fine and  just want to get rid of this warning.