0

I have a problem with a webserver that runs Centos4 with DirectAdmin.

Since a few weeks some websites hosted on it are not redirecting on search engines properly, they are redirected to some malware site, resulting in a ban from google.

Now I have used 3 virusscanners: ClamAV: Didn't find anything Bitdefender: Found a 2-3 files with JS infection, deleted them AVG: Finds lots of files, but doesn't have the option to clean!

The virus that it finds is: JS/Redir JS/Dropper

Still the strange thing is: website a (www.aa.com) does not have any infected files (have gone through all the files manually, is a custom PHP app, nothing special) but does still have the same virus. Website b (www.bb.com) does have the infected files as only one.

I deleted all these files and suspended the account, but no luck, still the same error.

I do get the log entries on the website from the searchengines so the DNS entries are not changed.

But now I have gone through the httpd files but cannot find anything.

Where can I start looking for this?

0

3 Answers 3

2

Maybe the problem is with the web server and not with the website itself? Perhaps the virus modified a script so that you can't detect the changes with a virus detector?

3
  • this may be the case.
    – egorgry
    Jan 2, 2011 at 20:43
  • I think this is the case too, but where to look? My httpd.conf is fine, and the includes in that file look OK too. No funny stuff in there.
    – Roger Far
    Jan 2, 2011 at 21:15
  • It might help to reinstall Apache and it's dependencies.
    – jmort253
    Jan 2, 2011 at 21:59
0

run chkrootkit and/or Rootkit Hunter I suspect that jmort253 is right and the server has been compromised. did you check for any funny .htacces files or conf files?

1
  • Yeah I checked, but because DirectAdmin is on the server it's hell to look for a problem, I am not familiar with all scripts so actual DA scripts can look suspicious. RK hunter gave no results luckily.
    – Roger Far
    Jan 2, 2011 at 21:15
0

Sounds like the binaries have been compromised. Difficult to contain, but not impossible. I'd def suggest backing up sites ONLY to a known good server - NOT keeping them on the same box.

Not the answer you're looking for? Browse other questions tagged .