Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind.

When I access some domains on that server (every 5 or 10 mins) it will redirect me to something like this.

http://imgur.com/cifDTBe

The stranger this is that it does not completely redirect!

The URL of my website is still the same, and if it left alone for me than 10 seconds it will comeback to the site.

I have ran some virus/malware scan on my local site to run out that it's not from the client but indeed from the server.

Has anyone seen something like this before?

share|improve this question
add comment

1 Answer

This is a malware which uses your websites to gain profit from advertisements. What you need to do now is fix your server. Best thing you can do is follow our canonical guide by Rob Moire which can be found here How do I deal with a compromised server?

share|improve this answer
    
Yeah, sorry @John. Perform the suggested fix, then consider switching to not letting that server on the Internet until it is properly secured. –  schroeder Nov 18 '13 at 19:29
    
@Lucas Kauffman - any chance you could provide some pointers (papers) to this kind of malware, please? –  Lex Nov 19 '13 at 8:13
    
threatpost.com/… and just google ;) –  Lucas Kauffman Nov 19 '13 at 8:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.