0

I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind.

When I access some domains on that server (every 5 or 10 mins) it will redirect me to something like this.

https://i.stack.imgur.com/hkupO.jpg

The stranger this is that it does not completely redirect!

The URL of my website is still the same, and if it left alone for me than 10 seconds it will comeback to the site.

I have ran some virus/malware scan on my local site to run out that it's not from the client but indeed from the server.

Has anyone seen something like this before?

Improve this question

1 Answer 1

Reset to default
2

This is a malware which uses your websites to gain profit from advertisements. What you need to do now is fix your server. Best thing you can do is follow our canonical guide by Rob Moire which can be found here How do I deal with a compromised server?

Improve this answer
3
  • Yeah, sorry @John. Perform the suggested fix, then consider switching to not letting that server on the Internet until it is properly secured.
    – schroeder ♦
    Nov 18, 2013 at 19:29
  • @Lucas Kauffman - any chance you could provide some pointers (papers) to this kind of malware, please?
    – Lex
    Nov 19, 2013 at 8:13
  • threatpost.com/… and just google ;)
    – Lucas Kauffman
    Nov 19, 2013 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .