Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

just detected some .htaccess malware on one of my servers (shared hosting). The provider (1and1) doesn't seem to care (we take a look into this on monday).

Is there any good place to report this attack? It seems to be a pretty new one, since Google only has a few hits on it.

I noticed it, since i was seeing this in Chrome when browsing my site:

Error 324 (net::ERR_EMPTY_RESPONSE): The server closed the connection without sending any data.

Don't want to post the "source" htaccess here, but it's listed on this pastebin:

share|improve this question

closed as off topic by Michael Hampton, John Gardeniers, mdpc, kce, Ward Jan 13 '13 at 6:46

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

This isn't really anything particularly new. – ceejayoz Feb 12 '12 at 18:13

What are you going to report? Do you know who did it? If it's typical of other attacks, you had a hole that was exploited (wordpress, SQL injection, ...) by any of the thousands of script kiddies out there. Most providers don't care in that there's no practical way to arrest anyone for it.

Your best bet is to get it restored from a backup from before the attack. You detected one file breached. Unless you have file checksums and monitoring in place, you don't know what else changed, so there could be a rootkit in there somewhere or it may be running scripts to do other damage.

Nuke the server, rebuild is the best way to do it.

Reporting what you learn to a blog post, see if others can learn from what you find. There are no Internet police. Your provider will most likely not care because it's your problem unless it affects their network or other customers.

share|improve this answer
Just checking logs and backups right now to see where i came from. It actually created a htaccess file on all virtual hosts. I'm aware of script kiddies and co. but since i did not find anything on Google about this specific one, i thought it might be a good idea to post it somewhere else to let people know that there's something to watch out for. Strange thing is it also created an rewrite htaccess even on directories that do not include a Wordpress install or something. I will dig into it and post about it, once i found out how it managed to do so. Thanks – bitrocker Feb 12 '12 at 18:42
There's no central repo of this information although you can check with sites like CERT. Malware companies treat their information and samples as proprietary (except for ClamAV). You can blog about it and that will get indexed by Google. That's really about it for getting the word out. – Bart Silverstrim Feb 12 '12 at 18:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.