I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind.

When I access some domains on that server (every 5 or 10 mins) it will redirect me to something like this.


The stranger this is that it does not completely redirect!

The URL of my website is still the same, and if it left alone for me than 10 seconds it will comeback to the site.

I have ran some virus/malware scan on my local site to run out that it's not from the client but indeed from the server.

Has anyone seen something like this before?

1 Answer 1


This is a malware which uses your websites to gain profit from advertisements. What you need to do now is fix your server. Best thing you can do is follow our canonical guide by Rob Moire which can be found here How do I deal with a compromised server?

  • Yeah, sorry @John. Perform the suggested fix, then consider switching to not letting that server on the Internet until it is properly secured.
    – schroeder
    Nov 18, 2013 at 19:29
  • @Lucas Kauffman - any chance you could provide some pointers (papers) to this kind of malware, please?
    – Lex
    Nov 19, 2013 at 8:13
  • threatpost.com/… and just google ;) Nov 19, 2013 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .