Getting screwed over, need urgent help.

[Nishant80]

Hi,
Since about a week we have been getting LOT of complaints from our datacenter about a few of our webs holding phishing pages, shells, deface pages etc etc. I have tried clamav, maldet but they don't seem to help a lot.

I just got another complaint. The site is not EXACTLY defaced, but it has a "hacked" page uploaded inside

wp-content/themes/twentyten/x.php

Not to mention the site is using wordpress. My question is, how can I check when and how this file was uploaded?

And what can I do to prevent these things?

[jerrybell]

Hi,
Not to mention the site is using wordpress. My question is, how can I check when and how this file was uploaded?

And what can I do to prevent these things?

you could try looking at the timestamp of the file, though it's conceivable that has been altered.

Most likely, the WP sites are running old versions of WP or plugins that are vulnerable to attack. Keeping them updated is probably the most effective way to prevent this, but that will likely be challenging. Mass updating of wordpress is pretty simple - there are a lot of scripts out there to do that. There aren't many for updating plugins, though. php-cli is one that looks promising, though I haven't played with it.

Other than that, compiling apache with suhosin will help some. Be sure you're not running mod_php or have something in place (like mod_ruid2) to keep one site compromise from allowing an attacker to drop exploit code on all sites you host.

There's no 100% solution.

[d'argo]

Also check your FTP logs, a lot of malware gets uploaded because of compromised user accounts.

[tank]

What about this. ConfigServer eXploit Scanner (cxs)

That might help. But that best thing to do, is to restore the site to a time, when it was not infected. And change the passwords to a more secure password.

[d'argo]

But that best thing to do, is to restore the site to a time, when it was not infected. And change the passwords to a more secure password.

Thats definitely the best advice. Usually its a stolen password that lets them in.

[cPanelTristan]

With WordPress, it's usually an old version actually. They don't need to steal passwords when WordPress has easily exploitable old versions that haven't been updated. Scanning frequently for out-of-date WordPress installs and informing the customer they need to update is the best course of action. If they don't update and get hacked, charging them to restore from a backup would work out well, since they were already informed and now you have to do the work they didn't do.