-1

some spam scripts in my server (it send thousands of mails/hr) i did scan to my server CentOS7 + Virtualmin using clamav , and this is the reuslts :

/home/joudakpk/homes/info/Maildir/cur/1555410522.27486_0.ser.voceweb.com: Email.Phishing.VOF1-6314019-0 FOUND
/home/joudakpk/homes/info/Maildir/cur/1554693257.32497_0.ser.voceweb.com: Email.Trojan.Toa-5493309-0 FOUND
/var/lib/clamav/rfxn.hdb: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/var/lib/clamav/rfxn.yara: {HEX}php.gzbase64.inject.452.UNOFFICIAL FOUND
/var/lib/clamav/rfxn.ndb: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/var/log/clamav/manual_clamscan.log: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/var/spool/postfix/deferred/9/988795815AA: YARA.r57shell_php_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs/md5v2.dat: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs/rfxn.hdb: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs/rfxn.yara: {HEX}php.gzbase64.inject.452.UNOFFICIAL FOUND
/usr/local/maldetect/sigs/md5.dat: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs/hex.dat: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs/rfxn.ndb: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/logs/event_log: YARA.r57shell_php_php.UNOFFICIAL FOUND
/usr/local/maldetect/sess/quarantine.hist: YARA.r57shell_php_php.UNOFFICIAL FOUND
/usr/local/maldetect/sess/hits.hist: YARA.r57shell_php_php.UNOFFICIAL FOUND
/usr/local/maldetect/sess/session.190502-0005.4595: YARA.r57shell_php_php.UNOFFICIAL FOUND
/usr/local/maldetect/sess/session.hits.190502-0005.4595: YARA.r57shell_php_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs.old/md5v2.dat: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs.old/rfxn.hdb: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs.old/rfxn.yara: {HEX}php.gzbase64.inject.452.UNOFFICIAL FOUND
/usr/local/maldetect/sigs.old/md5.dat: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs.old/hex.dat: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/sigs.old/rfxn.ndb: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/local/maldetect/clean/gzbase64.inject.unclassed: {HEX}php.gzbase64.inject.452.UNOFFICIAL FOUND
/usr/share/clamav/rfxn.hdb: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND
/usr/share/clamav/rfxn.yara: {HEX}php.gzbase64.inject.452.UNOFFICIAL FOUND
/usr/share/clamav/rfxn.ndb: YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL FOUND

----------- SCAN SUMMARY -----------
Known viruses: 6139866
Engine version: 0.101.2
Scanned directories: 123063
Scanned files: 643152
Infected files: 28
Total errors: 13042
Data scanned: 130821.71 MB
Data read: 109355.80 MB (ratio 1.20:1)
Time: 20850.863 sec (347 m 30 s)

first : i changed all users Passwords , main passwords , disabled root login. second : i deleted "info" folder and info user.

now i don't know what i should to do ?

1

I will reply here to make things a bit more easy to read.

Those files can be deleted. Then install rkhunter, this tool will scan your machine for probable modified binaries or bad things.

Then it doesn't mean your server will be clean. Under linux it's pretty easy to make nasty hidden things and you have to check your machine carefully. And by the way you also have to find how those guys could hack your server. If it's from a web page, you have to secure it to avoid them to come back. So, many things to check before to be "sure" your machine is clean

| improve this answer | |
  • rkhunter results : System checks summary File properties checks... Files checked: 126 Suspect files: 0 Rootkit checks... Rootkits checked : 486 Possible rootkits: 0 Applications checks... All checks skipped The system checks took: 2 minutes and 45 seconds Info: End date is Fri May 3 13:27:08 CEST 2019 also i plan to migirate to another Server with Cpanel/WHM but i want to make sure that this issue solved – Bassem Kamal M May 3 '19 at 12:23
  • 1
    Well, this is just a summary of your scan, we can't know is your server is clean or not or even if the "suspect" files are bad or not. And as I said to my last answer, it's pretty easy to hide bad things under linux. rkhunter is looking for "known" things but will not detect a crap home made script hidden in a home folder. – darxmurf May 3 '19 at 12:44
  • thank you ,, in your side what do you think i should to do ? – Bassem Kamal M May 3 '19 at 15:01
  • Well, if you have a clean full backup of the machine, I would use it to restore the server. If not and if the server is fairly easy to reinstall from zero, reinstall it. If it's complicated and long to reinstall (but then you should have backups...), try to clean it with the risk to keep bad files on it. – darxmurf May 4 '19 at 8:37
  • i did scan more times and results was 0 infected files, also i send one of the website backup (new backup after the issue) to scan it by All in One migration team ( wordpress migration plugin ) and it clear. also the spam attempts was stopped but i still see one attempts ( unknown sender to strange email ) every 30 min. or more – Bassem Kamal M May 4 '19 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.