Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My system: CentOS 6.2 64bit Apache 2.2.15 PHP 5.3.3 I have WordPress 3.3.1.

I have several domains on my server configured as virtual hosts. The path to website files is the following: /var/www/vhosts/

Logs file for this domain: /var/www/vhosts/

So, today I have found an unknown file "index.html" in logs directory. The website itself works fine and I can't see any changes to core files.

This index.html contains the following:

<META HTTP-EQUIV="Refresh" Content="0; URL="

This URL redirects to some wired chinese language courses on So, anyone has something similar or knows how does this file was uploaded to my server? Any log files I have to check?

Thank you for help!!!

share|improve this question

2 Answers 2

Check your website's directories (mostly theme directories, uploads directory, wp-admin subdirectories), and .htaccess files and the code of index.php, 404.php, wp-config.php. if there's something strange, you'll see. In my case, the first time had an cgi-ssh client in my twentyten theme directory, and the second time there was a eval(base64_decode()) code in every php pages.

share|improve this answer
could you find anything? – tpaksu Mar 19 '12 at 15:27
Hello tpaksu! Thanks for reply. Please read my answer above. – lokiby Mar 19 '12 at 15:28
Didn't find anything. I don't have twentyten theme, my own themes seems fine. index.php wp-config.php are clear. I have searched for "base64_" and "eval" - still nothing suspicious. Actually website works fine. – lokiby Mar 19 '12 at 15:29
well, they scan for every injectable script and try that.They have a brute force attacker with a lot of exploit definitions I guess. – tpaksu Mar 19 '12 at 15:35
I see, but I need to find out, how that file was uploaded to my server. :) This file was in logs directory with owner "root". So, whether it's apache vulnerability or as I have a VPS, it's an OpenVZ vulnerability. Or I don't know. – lokiby Mar 19 '12 at 15:49

I have checked WP, and can't see anything suspicious. I have break attempts like this from time to time: WordPress Firewall has detected and blocked a potential attack!

Web Page:

Warning: URL may contain dangerous content!

Offending IP: [ Get IP location ]

Offending Parameter: $_FILE = wp-xml.php

So, they are blocked by WP Firewall and I don't even have 1-flash-gallery plugin.

I think someone has tried to inject this "index.html" to my website, but it was saved to logs directory somehow. And I need to know how!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.