Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I have a linux packaged server (is that right?) that I run for a coworker. It has recently been hacked and I've been trying for the last few days to get rid of the malware. It now redirects most of my sites to http://gator65.hostgator.com/~db905/tds/out.php?s_id=1. What can I do?

share|improve this question

marked as duplicate by Jenny D, sysadmin1138 May 12 at 11:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

up vote 6 down vote accepted

Wipe the drive. Reinstall from known-good backup.

There are plenty of ways you can miss something that's installed and hidden on a server that's been rooted.

Unless you had hashes of all your files/binaries, you can't even tell if you're running the correct applications on your server. For all you know you're running altered system binaries that are specifically tailored to hide the malware. Your logs could be hiding information, and your system could be hiding network connections to spam/malware sites, and your system is distributing more warez/malware. Take it offline, restore it, fix the security holes and do all updates, and make sure your backup is from pre-rooting.

share|improve this answer
    
Except if I was evil-enough I would have replaced your md5susm binary with one that just reports the expected, valid hashes. +1 for rub, rebuild, restore. –  jscott Mar 16 '11 at 15:52
    
You could. I think you're supposed to have the hashes and binary available offline or on another machine. –  Bart Silverstrim Mar 16 '11 at 15:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.