hello,
i found out that my server is getting slower and slower.
on command top i get response that i have a lot svcrack.py and svwar.py processes active.
can you tell me what are those?
thank you in advance!
+2
A:
Somebody is running a password cracker on your server. If it's not you, then your server has been compromised. Tread carefully.
Greg Hewgill
2010-09-02 07:17:15
for what are used those two except passwords crack?
2010-09-02 16:03:52
A:
Doesn't sound nice anyway... Just googling those two process names returns me pages I can't open at work:
http://www.darknet.org.uk/tag/svcrack/
I would be investigating to see if the process running on your service is this, and if it is, taking some decisive action to stop it - unless you have it running for some reason?
All the results arelinked to VOIP and SIP.
Dave
Dave
2010-09-02 07:19:00
A:
Hi there - as everyone else said, that's part of SIPVicious, of which I'm the original author. Your server got compromised (somehow) and is being used to scan and compromise PBX servers open on the internet.
I would like more details about your case. Would be great if you could get in contact - [email protected]
- sandro
Sandro Gauci
2010-09-02 08:00:11
A:
I have the same problem. Under what name would they be? I can't find the scripts.
Carlos
2010-10-17 06:54:44