0

I have used Small HTTP server in the past, years ago. I went to its website do download it again, but it has a dubious WOT rating: some say it is malware, some say it isn't.

I proceeded to check it on VirusTotal, where it got 20 positive identifications. Out of those 20, 8 list it as "SmallHTTP" or "Server Web", a little uninformative to me. One say it is "riskware", while Ikarus and Kaspersky list it as "not-a-virus:Server-Web.Win32.SmallHTTP".

However, six other tools identify it with words such as "Backdoor", "malware", "trojan", etc.

ClamAv says it is a "Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat".

Is there any way to check if it is really malware?

  • 1
    Sounds like it's harmless per-se, but often used as part of malware. – CodesInChaos Oct 28 '13 at 12:33
  • And again AV scares all customers away from a legitimate product just because some people use the ̶t̶o̶o̶l hammer to destroy cars. – Johannes Kuhn Oct 28 '13 at 13:41
3

It is probable that some malware included a copy of this HTTP server, or some code which looks like this HTTP server, in order to, say, run a HTTP server on the infected machine. Being able to host parasitic servers on infected hosts is one of the goals of malware, and a lightweight HTTP server code (both in code size and RAM footprint) would be more appropriate for that than a heavyweight Apache or IIS, which would be much harder to smuggle in an email Trojan.

Now of course you cannot really know whether any given piece of software is malicious or not. In fact it is not fully defined: if a server code has a remotely exploitable bug, then it could be used a backdoor for attackers. Whether this bug is malicious or not depends on the intent of the software writer: was he aware of the bug ? It won't change a bit in the code, though.

With opensource software you could try to run your own audit of the code, which will be hard work and does not guarantee that all holes will be found (otherwise, we would know how to produce code without bugs), but that's better than nothing.

| improve this answer | |
  • Yeah, I opted for an OSS equivalent. Better safe than sorry. – That Brazilian Guy Oct 28 '13 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.