Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am running Plesk 9.5 on Ubuntu 8.04 LTS and have about 15 websites infected with some malicious code appended to the end of java files. I have installed Clamav and it has managed to pickup the infected files which have a pattern of starting with either /km0ae9gr6m/ or /gootkitstart/ and ending with /qhk6sa6g1c/ or /gootkitend/

My Plesk panel is up to date and security patches were installed. How can I isolate the security vulnerability on the server?

share|improve this question
    
By auditing the access controls and logs of your web site? –  psusi Jun 25 '12 at 14:06
    
Does this help you: forum.parallels.com/showthread.php?t=258101 –  Lekensteyn Jun 25 '12 at 14:15
    
Is there another common feature between the compromised sites? are they running the same version of some CMS (Drupal, Joomla, Wordpress)? that may be the attack vector you're looking for, even if Plesk and everything else is up to date. Also, you can look at the modification dates for the compromised files, and look at your log files for those dates/times, to see where the compromise came from, and which URLs they accessed. Usually they specify some very long and suspicious query strings. –  roadmr Jun 25 '12 at 15:28
add comment

1 Answer 1

up vote 1 down vote accepted

It turned out to be a Plesk vulnerability http://securitystreetknowledge.com/?p=771 that a microupdate managed to fix. We then reset all FTP and control panel passwords and the issue was resolved.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.