I am running Plesk 9.5 on Ubuntu 8.04 LTS and have about 15 websites infected with some malicious code appended to the end of java files. I have installed Clamav and it has managed to pickup the infected files which have a pattern of starting with either /km0ae9gr6m/ or /gootkitstart/ and ending with /qhk6sa6g1c/ or /gootkitend/
My Plesk panel is up to date and security patches were installed. How can I isolate the security vulnerability on the server?