Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running Plesk 9.5 on Ubuntu 8.04 LTS and have about 15 websites infected with some malicious code appended to the end of java files. I have installed Clamav and it has managed to pickup the infected files which have a pattern of starting with either /km0ae9gr6m/ or /gootkitstart/ and ending with /qhk6sa6g1c/ or /gootkitend/

My Plesk panel is up to date and security patches were installed. How can I isolate the security vulnerability on the server?

share|improve this question
By auditing the access controls and logs of your web site? – psusi Jun 25 '12 at 14:06
Does this help you: – Lekensteyn Jun 25 '12 at 14:15
Is there another common feature between the compromised sites? are they running the same version of some CMS (Drupal, Joomla, Wordpress)? that may be the attack vector you're looking for, even if Plesk and everything else is up to date. Also, you can look at the modification dates for the compromised files, and look at your log files for those dates/times, to see where the compromise came from, and which URLs they accessed. Usually they specify some very long and suspicious query strings. – roadmr Jun 25 '12 at 15:28
up vote 1 down vote accepted

It turned out to be a Plesk vulnerability that a microupdate managed to fix. We then reset all FTP and control panel passwords and the issue was resolved.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.