0

I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind.

When I access some domains on that server (every 5 or 10 mins) it will redirect me to something like this.

http://imgur.com/cifDTBe

The stranger this is that it does not completely redirect!

The URL of my website is still the same, and if it left alone for me than 10 seconds it will comeback to the site.

I have ran some virus/malware scan on my local site to run out that it's not from the client but indeed from the server.

Has anyone seen something like this before?

2

This is a malware which uses your websites to gain profit from advertisements. What you need to do now is fix your server. Best thing you can do is follow our canonical guide by Rob Moire which can be found here How do I deal with a compromised server?

  • Yeah, sorry @John. Perform the suggested fix, then consider switching to not letting that server on the Internet until it is properly secured. – schroeder Nov 18 '13 at 19:29
  • @Lucas Kauffman - any chance you could provide some pointers (papers) to this kind of malware, please? – Lex Nov 19 '13 at 8:13
  • threatpost.com/… and just google ;) – Lucas Kauffman Nov 19 '13 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.