I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They asked Bell to block our IP if we couldn't find it within an hour.
The folder was called "Show" and inside it was an index.phpPHP and a bunch of other files. I deleted it and now it's fine.
The folder rights were root:root. I believe it was added when the site admin uploaded a file from his PC. But how would the file ownerships be root:root?
How do I prevent such problems. Is there any linuxLinux packages that would help?
***In case its relevant the client is using phpMyFaq and the folder "Show" was inside the folder "Attachments".
P.s in my access.log I have a lot of these:
- 69.158.XXX.XXX - - [02/May/2011:12:32:18 -0400] "\x16\x03\x01" 501 368 "-" "-"
- 69.158.XXX.XXX - - [02/May/2011:12:32:18 -0400] "\x16\x03\x01" 501 368 "-" "-"
- 69.158.XXX.XXX - - [02/May/2011:12:32:18 -0400] "\x16\x03\x01" 501 368 "-" "-"
- 69.158.XXX.XXX - - [02/May/2011:12:32:18 -0400] "\x16\x03\x01" 501 368 "-" "-"
where XXX.XXX is a real IP...
Could it be related? After Googling these codes I always get something about SSL's.
Thanks
