0

I am running Plesk 9.5 on Ubuntu 8.04 LTS and have about 15 websites infected with some malicious code appended to the end of java files. I have installed Clamav and it has managed to pickup the infected files which have a pattern of starting with either /km0ae9gr6m/ or /gootkitstart/ and ending with /qhk6sa6g1c/ or /gootkitend/

My Plesk panel is up to date and security patches were installed. How can I isolate the security vulnerability on the server?

3
  • By auditing the access controls and logs of your web site?
    – psusi
    Jun 25, 2012 at 14:06
  • Does this help you: forum.parallels.com/showthread.php?t=258101
    – Lekensteyn
    Jun 25, 2012 at 14:15
  • Is there another common feature between the compromised sites? are they running the same version of some CMS (Drupal, Joomla, Wordpress)? that may be the attack vector you're looking for, even if Plesk and everything else is up to date. Also, you can look at the modification dates for the compromised files, and look at your log files for those dates/times, to see where the compromise came from, and which URLs they accessed. Usually they specify some very long and suspicious query strings.
    – roadmr
    Jun 25, 2012 at 15:28

1 Answer 1

1

It turned out to be a Plesk vulnerability http://securitystreetknowledge.com/?p=771 that a microupdate managed to fix. We then reset all FTP and control panel passwords and the issue was resolved.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .