I found several lines of this request in my web server access log:

Source IP       Dest IP Request                                                                 Stat User agent POST /?cmd=info&key=a7aa3875fc4422ca78f7b4216205b9a5&ip= HTTP/1.1 200 Net-Worm.PHP.Mongiko.a

Tried to Google, but found no information. What is Net-Worm.PHP.Mongiko and what is it trying to post on my website?

  • 5
    Malware which sends an honest user-agent string? That's really odd. Is that really the string it sends or is your web access log tool adding this on its own?
    – Philipp
    Commented Feb 22, 2015 at 14:47
  • 1
    That is most probably no malware. I really doubt any sane person would use an AV database virus designation in his request user-agents. On the other hand, remembering all the malware authors who never code when sober, the thing being malware could seem at least plausible.
    – Mints97
    Commented Feb 22, 2015 at 16:46
  • @Philipp tools for script kiddies often send honest user-agent to ensure those stupid lamers cannot do much damage. It's a sort of 1337 revenge ;) Commented Feb 25, 2015 at 17:26

4 Answers 4


This virus alert is a scam. The goal is to get admins to download and execute special "removal tools", which are in fact the actual virus.

Another note about how websites work and what you see in the access log: You can go to basically every website and append arbitrary parameters like ?cmd=foo&key=bar and the website will just load and ignore the parameter. This suspicious log entry may not mean anything at all!

Monitor your system closely to see if your it is indeed doing something fishy. E.g., by logging all HTTP traffic containing suspicious parameters.

The removal tool as advertised (There's a link in the comments - do not install), will open your firewall and allow an attacker to remote control your machine.

I recommend you also watch the thread following this freebsd-security mailing list post, if you want to know more.

  • 2
    For the aspiring reverse engineers: A suspicious removal tool (that is likely malware) can be found on hXXp://rkcheck.org/index.html (this link is intentionally broken. Do not install their software.)
    – freddyb
    Commented Feb 25, 2015 at 20:52
  • 2
    This is basically confirmed. It's fake. The removal tool is the actual malware.
    – Ariel
    Commented Feb 25, 2015 at 22:19
  • Thanks, I updated my answer. Feel free to edit right away, in the future!
    – freddyb
    Commented Feb 27, 2015 at 15:15

As freddyb said, this seems to be a scam. I looked at the "removal tool" for the virus - it contains an executable that forks off into the background, renames itself to udevd, connects to (that server seems to be down atm), sends the string FOG\n\n# and gives the server a reverse shell (by dup()ing the socket to fds 0,1,2, then executing the shell - this means that the server can then run arbitrary code on your computer). There is no way that that's a legit malware removal tool.


It looks like that's trying to communicate with a previously-installed program. I'd guess (from cmd=info) that it's trying to see if install was completed. ip= (which I assume is your IP anonymized) is telling it what IP it is trying to talk to, in case the traffic would come back from another IP.

It's probably nothing, just a scanner for some bit of malware. As long as your server doesn't respond positively you're fine.


This IP address is showing at present via i2p in the TOR browser. Somebody is using an anonymous network to get some sort of information from your server, and probably also has code there to send other commands to it.

  • I'd say it actually does.
    – Jens Erat
    Commented Feb 23, 2015 at 9:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .