Take the 2-minute tour ×

I am running Plesk 9.5 on Ubuntu 8.04 LTS and have about 15 websites infected with some malicious code appended to the end of java files. I have installed Clamav and it has managed to pickup the infected files which have a pattern of starting with either /km0ae9gr6m/ or /gootkitstart/ and ending with /qhk6sa6g1c/ or /gootkitend/

My Plesk panel is up to date and security patches were installed. How can I isolate the security vulnerability on the server?

share|improve this question
By auditing the access controls and logs of your web site? –  psusi Jun 25 '12 at 14:06
Does this help you: forum.parallels.com/showthread.php?t=258101 –  Lekensteyn Jun 25 '12 at 14:15
Is there another common feature between the compromised sites? are they running the same version of some CMS (Drupal, Joomla, Wordpress)? that may be the attack vector you're looking for, even if Plesk and everything else is up to date. Also, you can look at the modification dates for the compromised files, and look at your log files for those dates/times, to see where the compromise came from, and which URLs they accessed. Usually they specify some very long and suspicious query strings. –  roadmr Jun 25 '12 at 15:28

1 Answer 1

up vote 1 down vote accepted

It turned out to be a Plesk vulnerability http://securitystreetknowledge.com/?p=771 that a microupdate managed to fix. We then reset all FTP and control panel passwords and the issue was resolved.

share|improve this answer

Your Answer


