1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

Web Server Virus - HELP

Discussion in 'Plesk 9.x for Linux Issues, Fixes, How-To' started by atomic, Feb 10, 2012.

  1. atomic

    atomic New Pleskian

    Nov 12, 2008
    Likes Received:
    We are running plesk 9.3.0 and every once in a while we are having to shutdown httpd because of a tremendous amount of outbound traffic. The Traffic is to the point where it is slowing down our whole infrastructure.

    When it starts happening it overloads our Firebox x1250e. The Firewall shows no traffic but the load is full.

    The traffic monitor on the router stops at this point or slows to a crawl. If we unplug the server or stop httpd the overload stops immediately.

    It is very intermittent. We suspect it is a virus on one of the hosted sites that is triggered by visiting the infected site. Doing some research we feel it is "gootkit" or some variant "auto-rooter"

    The problem is we cannot find which site this is on or coming from.

    A little background, This particular setup is running Expand. 2 web servers, 1 mail server and one Expand server.

    For now we are running netstat and watching (tail) the access_log files.

    any info would be helpful.
  2. jneff

    jneff Guest

    This may be related to the sql injection vulnerability. We got hit by this, bad guys created malicious files on the server(s) and they were then triggered and caused a packet flood on our network yesterday.