All sites on the same servers are hacked with their own self-recovered files

[shanky]

All DirectAdmin servers have root login with SSH keys. I found that many virus files are spreading to all DirectAdmin accounts and all vps & servers.

An undead malicious file that will rebuild itself when deleted.

-rw-r--r-- 1 xxxx xxxx 374 Sep 12 12:10 accesson.php
-rw-rw-rw- 1 root root 10676 Sep 3 03:23 c5eXWE9oxH.php

Whenever I delete a lot of virus files, the deleted files will be undeleted in a few seconds or minutes.

The virus files are created and spread to all users very quickly, and the worst are all user accounts, even the "Admin".

If the Directadmin staff want to investigate, I can send all ssh passcode key details privately.

This is an extremely urgent case; please help.

 

[sysdev]

Well that sucks as normal useraccounts can't create files with those permissions (rw/root). This is a root compromise. I wouldn't even start cleaning that server but reinstall a clean one with heavily rotated credentials. Unless you have installed something like AIDE you'll never know what really changed outside userspace.

If you want to find out how it happend check all crontabs of all users, DA's customhooks, authorized_keys files, ld.so.preload stuff. Check for running but deleted processes with lsof. Use rpm toch check for changed systemfiles.

As you have root logins with ssh keys and it happened on all servers, check your jumphost or the system you use to login to the da servers. But a cleanup can take days without a clean baseline. Better reinstall and restore safe backups. At least from a decent time before sept 3.