i found out that my server is getting slower and slower.

on command top i get response that i have a lot svcrack.py and svwar.py processes active.

can you tell me what are those?

thank you in advance!

share|improve this question
up vote 3 down vote accepted

Somebody is running a password cracker on your server. If it's not you, then your server has been compromised. Tread carefully.

share|improve this answer
    
for what are used those two except passwords crack? – user198003 Sep 2 '10 at 16:03

as everyone else said, that's part of SIPVicious, of which I'm the original author. Your server got compromised (somehow) and is being used to scan and compromise PBX servers open on the internet.

I would like more details about your case. Would be great if you could get in contact - sandro@enablesecurity.com

  • sandro
share|improve this answer

Doesn't sound nice anyway... Just googling those two process names returns me pages I can't open at work:

http://www.darknet.org.uk/tag/svcrack/

http://webcache.googleusercontent.com/search?q=cache:70I2elB01lQJ:sipvicious.org/blog/2007/11/introduction-to-svcrack.html+svcrack.py&cd=1&hl=en&ct=clnk&gl=uk

I would be investigating to see if the process running on your service is this, and if it is, taking some decisive action to stop it - unless you have it running for some reason?

All the results arelinked to VOIP and SIP.

Dave

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.