Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

Recently my site's index.php file was replaced with some malicious javascript code.

I really don't know how it was added to the page.

Today when I tried to download the file via FTP, my local anti-virus software gave me a warning. I presume this means it was not uploaded from my computer.

Is there any way to install anti-virus software on my VPS (running CentOS 5 and Cpanel/WHM)?

Also what is mod_security. Will it be helpful in future?

share|improve this question

marked as duplicate by Falcon Momot, Bryan, Jenny D, voretaq7 Jul 1 '13 at 16:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

There are a few places to start:

- Who was the owner of the file in question?

If the file was owned/writable by the Apache user the compromise could be in your actual code. If the file isn't owned/writable by Apache I'd next look at FTP.

- Have you checked the FTP logs?

Look through the logs and see if someone has downloaded your file, then re-uploaded a few seconds later (now with malicious content). This indicates your FTP details have been compromised. This is normally either by guessing an easy password, or by intercepting them, often from a compromised local windows PC used to upload the files.

The style of attack you describe is quite common. It's not an advanced attack, and will normally just be exploiting a simple security hole in your system (insecure passwords, poorly written code, etc).

mod_security is used to detected malicious code being executed by Apache (for instance SQL injection attacks). It won't stop the code being uploaded in the first place.

And in answer to your question, yes there are anti-virus applications available for Linux. Have a search for ClamAV as a starting place.

share|improve this answer

With ModSecurity's @inspectFile operator and the modsec-clamscan.pl, you can check a file's content with below rule:

SecRule FILES_TMPNAMES "@inspectFile /path/to/modsec-clamscan.pl" "phase:2,t:none,deny,log,msg:'Malicious code identified.'"

Have a look at this.

share|improve this answer