Hacked - Cannot find file

[kevinsan]

I have a VPS and this week we found a link to this file on our VPS. It is part of a phishing attack that pulls a moneybookers registration page using our VPS.

The url looks like this:


http://ipaddress/ /www.moneybookers.com/app/login.html or
http://ipaddress/ /www.moneybookers.com/app/login.html

The question is how do I find this file or website on my server. How can I delete this file or website on my server?

What I have tried:

Deleting all user account on the server. Then tuning off all reseller accounts. Unfortunately the url still works.

The people I purchased the VPS from are no help.

 

[nobaloney]

Search for the specific files on your server; search the /var/www/ path on your server. If the files aren't in either location then you probably should rebuild it.

Since you've already deleted all your accounts, you should probably reinstall anyway, from the VPS image supplied by your VPS provider.

Jeff

 

[ramprage]

Check your httpd.conf - what is the first site and folder that comes up for that IP address?
Then go check the directory that comes up on the server and search for strange folders - in particular one named with a (space), the files will be in there.

 

[chatwizrd]

find / -name login.html