View Single Post
  #1  
Old 23rd January 2010, 17:33
kerubino kerubino is offline
Junior Member
 
Join Date: Jan 2010
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Unhappy Default apache pages modified????

Hi,

I would like to ask you what to do if you think that your ISP config and your system has been hacked.

Which is the first steps to do?

Our sites has been hacked in this way:

At some time (i could not reach yet precisely) all defualt pages of apache are automatically modified.

For instance: index.php, index.html...

Default pages are modified adding an iframe that redirects you to a suspicious antivirus, antimalware or stats webpage.

Is surprising because all default pages are modified with the same TIMESTAMP.

I had checked all my crons, but i didn't see any suspicious... maybe is a bug of ISP config, i don't know.

We have 2.2.32 of ISP config on a Debian 5 64bit machine.

I thank you for you help in advance.
Reply With Quote
Sponsored Links