Proces

[Farshad@]

My server is at the moment attacked by dDos or it have been hacked or there are software problems. The serverload is too high and I can't login, but sometime the serverload is lower and I can login.

I use ver 7.51.

Mayby you can make something in the plesk admin to see what kind of proces there are running and how much CPU they use, on that way I can know what makes the problem and then I can fix it.

Kind regards

 

[smtalk]

Use "ps auxww" in ssh.

 

[Farshad@]

I am infected with Santy worm...

Anyone know how to delete this worm?

 

[smtalk]

Take a look at: http://www.securityfocus.com/archive/1/385063

There is a lot of posts in: http://www.phpbb.com/phpBB/viewforum.php?f=1

You can block it using mod_security with these settings:

SecFilter "viewtopic\.php\?" chain 
SecFilter "chr\(([0-9]{1,3})\)" "deny,log"

Or using .htaccess with code:

RewriteEngine On
RewriteCond %{QUERY_STRING} ^(.*)highlight=%2527
RewriteRule ^.*$   -   [F,L]

 

[Farshad@]

Thank you very much!

In my .htaccess I have now this":


DirectoryIndex index.html index.htm portal.php index.php
RewriteEngine On
RewriteCond %{QUERY_STRING} ^(.*)highlight=%2527
RewriteRule ^.*$ - [F,L]

And I think its working.

Thanks!

 

[smtalk]

Originally posted by Farshad
Thank you very much!

In my .htaccess I have now this":


DirectoryIndex index.html index.htm portal.php index.php
RewriteEngine On
RewriteCond %{QUERY_STRING} ^(.*)highlight=%2527
RewriteRule ^.*$ - [F,L]

And I think its working.

Thanks!

Thats okay, now you have to remove unknown files in /tmp

 

[Farshad@]

Oké, I used this command in SSH:

rm -rf /tmp/*


P.S.: The server is now 4 hours up and everything is working fine again!