1

Another behaviour I found on a website with malware issues.

It keeps downloading random files like one named s2bbGoEJ.html to users computers. It actually tried to automatically download one such file on my own computer. This looks like a 0 byte file.

How do I go about finding this malware and removing it. This has brought our business to knees and we need desperate help.

Edit: I have tried every Linux scanner I could find (ClamAV, rkhunter and couple more) with no luck whatsoever.

Drupal 7.91, Centos 8, PHP 7.2

Improve this question
10
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Mar 14 at 21:55
  • Web servers do not download a file, unless the web browser requests the file. This is the nature of HTTP(S) protocol. The first step to diagnosing this is to figure out what is causing the user's web browser to request these random files.
    – mti2935
    Mar 14 at 22:02
  • Thanks - is it possible that my browser or personal computer is compromised too. I can confirm that my browser requested (as you say) a file while just browsing pages and my server provided it as a download instead of opening it despite being an HTML file.
    – JM John
    Mar 14 at 22:07
  • As mentioned on your previous questions, there is no indication, yet, that your server is compromised. If this is affecting your business, then random strangers on this site are going to be of little help. You need someone to actually look at the situation.
    – schroeder ♦
    Mar 14 at 22:17
  • 1
    @JMJohn, then the most likely explanation is that a page on your site that you surf to first (such as your home page) is infected, with references to these random pages. Try to identify the first page, then look at the source of this page to see if anything looks malicious.
    – mti2935
    Mar 15 at 10:14

1 Answer 1

Reset to default
0

It turned out a hacked Memcached installation. They took control of memcached server and changed the file permissions/security settings on files folder and executed scripts from there.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.