Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm having a weird issue today. I was writing and testing out some simple cgi scripts this morning when I realized that I couldn't run them from one of the other computers on the (windows) network. So I had my network admin come in and take a look at what was going on. A few minutes later a co-worker came in and told me that a bunch of files he was working with as well as a bunch of others (all *.c files) on the network drive got deleted. He also noticed some strange apache_dump_500.log.txt files in the same directories where the files got deleted.

The apache_dump_500.log.txt files all look like this:

REDIRECT_HTTP_ACCEPT=*/*, image/gif, image/x-xbitmap, image/jpeg
REDIRECT_HTTP_USER_AGENT=Mozilla/1.1b2 (X11; I; HP-UX A.09.05 9000/712)
REDIRECT_PATH=.:/bin:/usr/local/bin:/etc
REDIRECT_QUERY_STRING=
REDIRECT_REMOTE_ADDR=<my computer's local ip>
REDIRECT_REMOTE_HOST=
REDIRECT_SERVER_NAME=<my computer's domain url>
REDIRECT_SERVER_PORT=
REDIRECT_SERVER_SOFTWARE=
REDIRECT_URL=/cgi-bin/trojan.py

I looked and I don't have any trojan.py in my cgi-bin folder. And all my apache logs are clean. Windows event logger seems to not have any traces of what happened either.

My httpd.conf: http://pastebin.com/Yny2Yh8v

I think we've got some kind of virus that added this trojan.py file to my cgi-bin, ran the script, and deleted the script and any traces from the logs. Is this a thing that happens?

Any ideas whatsoever would be much appreciated!

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Is it possible? Sure. If the permissions in the folders allow for a user of the executing process's privileges to delete files, a script can easily run to delete/alter files then delete itself.

I find it odd, though, because today's worms and viruses are mostly targeted at a secondary purpose like stealing information and monitoring users to steal information (passwords, documents, etc.) so unlike viruses of the past to highlight cleverness and creativity in their destructive payloads, most malware today doesn't want to draw attention to itself. That said it's very odd for a script from a generic hack to name itself something as obvious as "trojan" and go on to try ruining a website to keep it from running unless it was someone internal or with an agenda. That would be my suspicion.

That said, are you seeing more redirects in the log?

Do all your developer machines and servers have updated antivirus and malware scanners? Spybot? Ad-aware?

If the server is believed to have been hacked, you can't trust it anymore as it may have back door software and/or logging software. Once something has run to delete files and there's no other trace of what happened, if I were calling the shots I think I'd want to wipe and reinstall from a known good backup. There's just too much of a chance that something could have installed hidden back doors. Your dev workstation may have something installed too, and I'd scan all of them with the latest malware detection software and antivirus.

You could try running an undelete program on the hard disk or a block-level clone of the drive (offline, attached as a secondary volume to another computer so it's not executing the OS and code) to see if there was a program in that directory that matches that redirect, then you can try analyzing the data. But that entirely depends on your in-house expertise, time, and need to know (and how easily it would work if your server has a RAID volume, as it may not be feasible to do so if you need to restore the server.) If this is a production server I'd think you couldn't take much time to check on this. If it's a dev server, you may be able to spare the day or two to putz around with it in a more or less "clean" way to satisfy your curiosity or investigation needs. Just be really careful with exposing it to the network (keep it offline!) and preferably don't even boot the OS from that drive as that can run background trojans that will infect other things. I'd run it as a secondary data drive or from a bootable Linux CD to analyze the drive. There are a number of forensic boot distros available with tools for cloning or analyzing the drive if that's the direction you want to go.

share|improve this answer
    
Thanks for the insight. –  jjfine Apr 8 '10 at 14:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.