Virus on VPS(Ubuntu with Plesk 8) system

[Satwinder]

Hi,

I am using VPS from WebFusion (Ubuntu with Plesk 8). It is showing merrychristmasdude virus. Please help and suggest what should I do in this case. Which antivirus should I use to remove the virus?

Earler it was showing the virus on our site based on oscommerce which was removed manually by uploading the fresh site.

This came into notice as I have password protected the site using .htaccess, when I open the site in browser and do not enter the password and press cancel there, then it takes me to this virus affected link.

I am not able to locate the affected site. This seems that some Apache files are affected as I have checked the site files, they are not affected

Please let me know what should I do, Please revert for any input from my side.


Thanks and Regards,
Satwinder

 

[atomicturtle]

Sounds like the box was probably compromised, and its now set up to serve malware. Ive started a rough wiki page on some forensic procedures to follow here:

http://www.atomicorp.com/wiki/index.php/Compromised_System