I have an AWS server running Windows 2016 Datacenter. From the past few days, Windows Defender has been reporting Trojan:PHP/Obfuse.AR!MSR pointing to random phpXXXX.tmp files inside C:\Windows\Temp folder. I checked there are many files of that type in the temp folder but only 2-3 are reported by Windows Defender as infected. I tried opening these files (after downloading to local PC) in notepad and found they have some HTML &amp; PHP code, primarily a form with file input. I tried searching for this on Google and some articles suggested that these are hack attempts. The only reason I have PHP enabled on Windows Server is because we need to run a WordPress site. The CPU and RAM usage on server has also increased over the last 10-15 days. It used to stay below 10% but now it varies between 30-40% with Windows Defender being the highest contributor. Is this bad? What steps should I take to investigate further and secure the server? Any directions would be helpful. Unfortunately, we cannot afford to engage a professional to look into this matter.
281
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
75190
I have a server with a LSI MegaRAID 9261-8i controller. Recently I started getting alerts like this one:  Controller ID: 1  Consistency Check inconsistency logging disabled, too many     inconsistencies on VD: 0 Generated on:Sat May 12 04:06:40 2012   SYSTEM DETAILS--- IP Address: 192.168.1.29 OS Name: Windows 7 x64 OS Version: 6.01 Driver Name: megasas.sys Driver Version: 4.5.1.64  IMAGE DETAILS--- BIOS Version: 2.120.33-1197 Firmware Package Version: 12.12.0-0045 Firmware Version: 3.21.00_4.11.05.00_0x05000000   VD 0 is a RAID mirror containing the system disk.  I have searched and read, but cannot find any trace of how to actually do anything about this. I tried running a scandisk but that did not find anything (as I expected, since scandisk reads the disks as exposed by the controller, right?). The MegaRAID Storage Manager does not as far as I can see have any options for checking or fixing physical disks. The program claims the VD is "healty", and both disks have Error count 0.  Also a bit strange is the System details in the message... The IP address is associated with the RAS (dial in) interface, and the OS should be Windows Server 2011 SBS.  Has anyone else experienced this before? What can be done?
12087
I know this question is looking like an easy question or not a question at all but it's not really easy question. I'm not related to security and anti-viruses and just don't trust every provided anti-virus.  So first question is a real question - Is it OK (safe) to not use anti-virus at all. I know how to use firewall, usually I use only trusted connections and surfing trusted sites. My chances to get virus is really low. Even I've got a bit outdated PC and don't want to pay the performance for it. I can do monthly scans without having one installed - is it OK to be safe ?  If not can you recommend a good free antivirus solution?
28522
On Windows 10 Professional, with the November update (Build 10586, Version 1511) , is there any possibility to completely remove Windows Defender ?  I don't want to just disable Windows Defender.  I want to completely uninstall from my system.
115256
I'm new to Ubuntu.  I'm now setting up an OwnCloud server which supports ClamAV file scan.  Since most of the users connected to the server uses Windows OS, can ClamAV scan for Windows virus?  I also did some research that such as BitDefender. It clams that it scans real time, if someone upload files to the server, will BitDefender scan the file even OwnCloud doesn't support?  By the way, I heard that if I update the system frequently, I don't have to install any antivirus that scan for Linux virus. Is that right?
4957
I thought that there was no need to scan for viruses either in Ubuntu or any Linux distros until I found virus scanner packages clamtk and klamav in Ubuntu software center yesterday.  This leads to the following questions:   How do viruses differ between Linux and Windows? How do the strategies for protection differ between Linux and Windows? Should a virus scanner package be installed on my system? If so, which would be a better option?
103557
Windows Defender keeps blocking a third-party program that I know isn't a threat. All my attempts to disable Windows Defender have failed.  I've tried to:   Go in the Windows Defender option and disable it from there. Edit the group policies, find the Windows Defender file and edit the "turn off Windows Defender" to be always disabled. Prevent the Windows Defender service from even starting but the option appear to be greyed out.   How do I turn it off permanently?
55670
Often I find guid-like folder names spread around on my hard drives. Is there a way to prevent this from happening? I think they might come when I install various programs or while updating them (seems like windows update does it too).   I find it very annoying. Especially when some of them won't be deleted because of security stuff. Doesn't Windows have a dedicated temp folder for these cases? Why can't they use that? Or at least clean up after themselves...
62717
Today I found something strange on my newly installed Windows 7 OS - my "users" folder C:\Users was shared and "Everyone" had full access... I disabled that and now it seems fine, however I'm a bit scared actually, I'd like to know what caused that and if my system is compromised.
68359
I noticed today that McSvHost.exe (part of McAfee LiveSafe running on Windows 10) is sending traffic to every host on my network on UDP port 2054. This is what the packets look like (the part with Xs was actually the sender's MAC address):     0x0000:  4500 0038 16c5 0000 8011 d2c9 0a14 1e01  E..8............     0x0010:  0a14 1efe d13b 0806 0024 ba22 0001 0800  .....;...$.&quot;....     0x0020:  0604 0001 XXXX XXXX XXXX 0a14 1e01 ffff  ........V[......     0x0030:  ffff ffff 0a14 1efe                      ........  ...and here's Process Monitor showing McSvHost.exe sending the packets:  My questions are—  Is this expected behaviour, or should I be suspicious? and If it is expected behaviour, what is McAfee trying to do?  I've checked and nothing on my computer is listening on UDP port 2054.  I've tried contacting McAfee support but I struggled to make the support agent understand my question.
13930
Had my website hacked through a plugin 3 weeks ago.  rebuilt the site with a new wordpress site (hosted on Godaddy wordpress pro).  this was a fresh build.  All the built in malware checks in wordpress plugins and also google's console checks are good and clean.  Google ads wont run as it reports I have three malicious links in my website.  They gave me the link addresses but they are nothing I can locate.  Anyone have ideas on how to find what google found?
33135
I'm suffering from a spam hack where my site periodically starts to show Viagra spam to Google and other spiders. The method of the hack is basically that my .htaccess file gets modified to route all requests through a file called "common.php", which is a big chunk of base64 encoded evilness.  I've noticed it happening on a weekly basis: every time I remove the hacked files, it pops back up a few days later. These are the steps I've already taken to secure things:   Changed my FTP password Scanned my (shared hosting) directories for world-writable (777) files/folders and changed them to 755 or something more appropriate Removed old copies of Wordpress from unused directories (the site itself is a custom-written PHP CodeIgniter app) Downloaded the entire site to my local box and scanned the directories for occurences of strings like "base64" and ".ru" (spam domains?).   I'm a little uncertain what to do next as the problem still seems to be there. Is there some smart shell command I can run to figure out how these files are being uploaded? When I last checked, the .htaccess file was edited today by my own FTP user despite me changing the password a week ago and logging out any logged-in users. I don't leave it logged in on public machines, and a few other administrators of the site haven't been given the new password yet.  Any tips / ideas gratefully received. I'm happy to provide the output of any specific commands as needed.  Matt
102923
We recently saw that a particular domain (lets say it is recipient.com operated by recipient ltd) of newsletter recipients block our newsletter quite often. Therefore we asked the operating company of that domain what is wrong with our newsletters.  Recipient LTD told us:        Use  and that this is the reason why   our newsletter are regarded as spam or virus and get blocked.   Only refer to valid, trusted URLs in your e-mails and make sure that   there is no risk of confusion. Don't link to a phishing site and don't   quote or forward links to malware or spam. Also not as an example or   for fun!   For security reasons, our servers do not allow unencrypted   transfer of executable formats such as those used by viruses, worms   and Trojans.         Examples: ade, adp, app, asp, bas, bat, bhx, cab, ceo,   chm, cmd, com, cpl, crt, csr, der, exe, fxp, hlp, hta, iframe, inf,   ins, isp, its, js, jse, lnk, mad, maf, mag, mam, mar, mas, matte, mde,   mim, msc, msi, msp, mst, ole, pcd, pif, reg, scr, sct, shb, shs, vb,   vbe, vbmacros, vbs, vsw, wmd, ws, wsc, wsf, wsh and xxe.Because spam or virus sender often use links with ids to cover the real target of that url.          Furthermore we saw that we created every link in our newsletter with https but it gets wrapped like:   http://click.ourdomain.com/?qs=65a074a335071185581e968250a74788b72109cb3c4eec81f11a111eac1696522ec229b01733cb96b9ede10b706c1ae6a688533974ef5952   (we selfhost the dns entries and do not use a subdomain or different domain to send our emails)   The open tracking looks like this:  http://click.ourdomain.com/open.aspx?ffcb10-fec41577776c0078-fe5f1077716c047d7713-fe4615111564047e701470-ff5f17757d-fe5a11727c61027d7217-ffce15  Questions:   How can we configure salesforce to wrap these links in https? Has anybody else experienced problems that the tracking functionality (opens,clicks,...) of newsletters causes block bounces?
55136
First of all, I'm not looking for miracle... I know how PHP works and that there's not really way to hide my code from the clients without using encryption. But that comes with the cost of an extension to be installed on the running server.  I'm looking for something different though... I'm not looking to encrypt my code or even obfuscate it. There are many PHP scripts without encrypted/obfuscated code but they are commercial applications. For instance, vBulletin and/or IP.Board forum applications.  I just want to know what approach do these guys use for their applications...  I'm also open to any other suggestions.  Please note that I'm a single person and not working for a company. My product is also very specific, it won't sell that much. I just want you guys to know that I can't afford to consult a legal professional either to sue someone or prepare a commercial license. I'm just looking for a simple way to protect my simple product, if it's indeed possible, somehow...
102946
Whenever a search is performed in Windows 7 on a folder that is not indexed, Windows throws up a banner at the top of the Explorer window (below the address bar) blabbing about Indexing and asking you to turn it on and index the folder:    After the thousandth or so time, that warning/prompt/banner flashing and its [x] needing to be clicked gets to be really annoying. I heard you the first time!!!  Worse, this still occurs even when the Indexing service is disabled, and Indexing is un-selected and all of the relevant options.  (Windows is acting like a stupid person who cannot understand a simple concept like yes, I heard you the first thousand times, but no, I don’t want to use it, now leave me alone! and so keeps bugging you anyway.)  Is there a way to disable the banner short of hacking explorer.exe?  What’s particularly aggravating is that I have already disabled and removed the Indexer from Windows and yet it still tries to use it and then complains when it can’t. Well duh; it’s been removed:
73904
When is it a good idea to use ?  I sometimes see this in code samples of PHP. Does this handle DOS/Mac/Unix endline issues?
64739
I have a problem with a virus in windows 7, I don't know what kind of virus is infected my OS, I installed kasersky antivirus, and clear all detected viruses. After that I can't open any antivirus sites, can't ping any antivirus sites. example:  C:\Windows\system32&gt;ping kaspersky.com Pinging kaspersky.com [38.117.98.231] with 32 bytes of data: General failure. General failure. General failure. General failure.  Ping statistics for 38.117.98.231:     Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),   When I ping to other sites, I get reply normally: example woth pinging to google.com  C:\Windows\system32&gt;ping google.com  Pinging google.com [31.7.160.224] with 32 bytes of data: Reply from 31.7.160.224: bytes=32 time=2ms TTL=61 Reply from 31.7.160.224: bytes=32 time=2ms TTL=61 Reply from 31.7.160.224: bytes=32 time=1ms TTL=61 Reply from 31.7.160.224: bytes=32 time=1ms TTL=61  Ping statistics for 31.7.160.224:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 1ms, Maximum = 2ms, Average = 1ms   I tryed any antispyware/antimalware softwares, but null results.  Anyone else encountered this problem?