Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem with a webserver that runs Centos4 with DirectAdmin.

Since a few weeks some websites hosted on it are not redirecting on search engines properly, they are redirected to some malware site, resulting in a ban from google.

Now I have used 3 virusscanners: ClamAV: Didn't find anything Bitdefender: Found a 2-3 files with JS infection, deleted them AVG: Finds lots of files, but doesn't have the option to clean!

The virus that it finds is: JS/Redir JS/Dropper

Still the strange thing is: website a (www.aa.com) does not have any infected files (have gone through all the files manually, is a custom PHP app, nothing special) but does still have the same virus. Website b (www.bb.com) does have the infected files as only one.

I deleted all these files and suspended the account, but no luck, still the same error.

I do get the log entries on the website from the searchengines so the DNS entries are not changed.

But now I have gone through the httpd files but cannot find anything.

Where can I start looking for this?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Maybe the problem is with the web server and not with the website itself? Perhaps the virus modified a script so that you can't detect the changes with a virus detector?

share|improve this answer
    
this may be the case. –  egorgry Jan 2 '11 at 20:43
    
I think this is the case too, but where to look? My httpd.conf is fine, and the includes in that file look OK too. No funny stuff in there. –  Rogier21 Jan 2 '11 at 21:15
    
It might help to reinstall Apache and it's dependencies. –  jmort253 Jan 2 '11 at 21:59

run chkrootkit and/or Rootkit Hunter I suspect that jmort253 is right and the server has been compromised. did you check for any funny .htacces files or conf files?

share|improve this answer
    
Yeah I checked, but because DirectAdmin is on the server it's hell to look for a problem, I am not familiar with all scripts so actual DA scripts can look suspicious. RK hunter gave no results luckily. –  Rogier21 Jan 2 '11 at 21:15

Sounds like the binaries have been compromised. Difficult to contain, but not impossible. I'd def suggest backing up sites ONLY to a known good server - NOT keeping them on the same box.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.