Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I have a problem with a webserver that runs Centos4 with DirectAdmin.

Since a few weeks some websites hosted on it are not redirecting on search engines properly, they are redirected to some malware site, resulting in a ban from google.

Now I have used 3 virusscanners: ClamAV: Didn't find anything Bitdefender: Found a 2-3 files with JS infection, deleted them AVG: Finds lots of files, but doesn't have the option to clean!

The virus that it finds is: JS/Redir JS/Dropper

Still the strange thing is: website a ( does not have any infected files (have gone through all the files manually, is a custom PHP app, nothing special) but does still have the same virus. Website b ( does have the infected files as only one.

I deleted all these files and suspended the account, but no luck, still the same error.

I do get the log entries on the website from the searchengines so the DNS entries are not changed.

But now I have gone through the httpd files but cannot find anything.

Where can I start looking for this?

share|improve this question

marked as duplicate by HopelessN00b Apr 3 '15 at 17:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 2 down vote accepted

Maybe the problem is with the web server and not with the website itself? Perhaps the virus modified a script so that you can't detect the changes with a virus detector?

share|improve this answer
this may be the case. – egorgry Jan 2 '11 at 20:43
I think this is the case too, but where to look? My httpd.conf is fine, and the includes in that file look OK too. No funny stuff in there. – YesMan85 Jan 2 '11 at 21:15
It might help to reinstall Apache and it's dependencies. – jmort253 Jan 2 '11 at 21:59

run chkrootkit and/or Rootkit Hunter I suspect that jmort253 is right and the server has been compromised. did you check for any funny .htacces files or conf files?

share|improve this answer
Yeah I checked, but because DirectAdmin is on the server it's hell to look for a problem, I am not familiar with all scripts so actual DA scripts can look suspicious. RK hunter gave no results luckily. – YesMan85 Jan 2 '11 at 21:15

Sounds like the binaries have been compromised. Difficult to contain, but not impossible. I'd def suggest backing up sites ONLY to a known good server - NOT keeping them on the same box.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.