Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This week our server was subjected an attack where files were infected with malicious code. The intrusion was narrowed down to be due to a hole in Plesk, covered by the patch here - http://kb.parallels.com/en/112303.

The files have been cleaned and the patch applied, but I am no longer able to log into the control panel, due to the following error:

Warning: require_once(class.Session.php) [function.require-once]: failed to open stream: No such file or directory in C:\Program Files (x86)\Parallels\Plesk\admin\auto_prepend\auth.php3 on line 153

Fatal error: require_once() [function.require]: Failed opening required 'class.Session.php' (include_path='C:\Program Files (x86)\Parallels\Plesk\admin\plib;C:\Program Files (x86)\Parallels\Plesk\admin\plib\api-rpc;C:\Program Files (x86)\Parallels\Plesk\admin\javascripts;C:\Program Files (x86)\Parallels\Plesk\admin\plib\locale;C:\Program Files (x86)\Parallels\Plesk\admin\auto_prepend;C:\Program Files (x86)\Parallels\Plesk\admin\htdocs\domains\databases\phpMyAdmin;C:\Program Files (x86)\Parallels\Plesk\admin\htdocs\domains\databases\phpPgAdmin') in C:\Program Files (x86)\Parallels\Plesk\admin\auto_prepend\auth.php3 on line 153

The server is Windows 2003 SP2, and the version of Plesk is 8.6.

Can anyone help? I've also posted this on the Parallels forum but they don't seem bothered to respond!

share|improve this question
add comment

2 Answers 2

Restore your server from a backup prior to the intrusion, and repatch. Do you really trust anything on that server now? How can you truly be confident the intrusion hasn't left behind broken code and other exploits?

share|improve this answer
    
Re-installing the whole server from backups is no quick feat. It's a massive job for anyone so thats a last resort. Parallels were quite helpful in the end and have solved the issue, which was due to permissions on the patched files. The copied files only had Administrator access and not the correct Plesk user permissions. –  Buckers Jul 13 '12 at 15:37
    
I know it's a huge job, but here's my question, are you 100% sure you've eradicated all the exploited code? If so - how? –  EightBitTony Jul 13 '12 at 15:47
add comment

Have you tried rebooting? According to http://forum.parallels.com/showthread.php?t=257904 that is the fix for this issue.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.