kazani
03-13-2010, 10:10 AM
Hello I have a problem with my site and need some help.
It seems that some changes have be done. Days before that I had some complaints about attempts from one of my scripts to connect to a smtp server. My host says that they did nothing and guess maybe the datacenter did some changes. I cant figure out what I have done to fix it.
My site was working properly but suddenly some issues come out.
1- 2 javascript menus do not work
2- tags in my language Greek do not work
example
mysite.com/tags/iphone/ works just fine
mysite.com/tags/%F3%F7%DD%F3%E5%E9%F2/ does not work anymore
3- even the WHM login has changed and the pop-up window with login info dows not load anymore
I assume that some changes were done to security options in the server configuration but I can find it.
I have just made a scan through WHM and the result was:
Possible Trojan - /usr/bin/xmlcatalog
Possible Trojan - /usr/bin/xmllint
Possible Trojan - /usr/bin/xml2-config
Possible Trojan - /usr/lib64/python2.4/site-packages/libxml2mod.la
Possible Trojan - /usr/lib64/python2.4/site-packages/libxml2mod.so
Possible Trojan - /usr/bin/xml2-config
Possible Trojan - /usr/sbin/pureauth
Possible Trojan - /usr/sbin/antirelayd
Possible Trojan - /usr/bin/cpan
Possible Trojan - /usr/bin/instmodsh
Possible Trojan - /usr/bin/prove
Possible Trojan - /etc/cron.daily/logrotate
12 POSSIBLE Trojans Detected
Also the Mod Security in WHM gives me a warning about the tags in Greek that use % symbols in the url..
Can anyone give me a clue about it?
thanks
It seems that some changes have be done. Days before that I had some complaints about attempts from one of my scripts to connect to a smtp server. My host says that they did nothing and guess maybe the datacenter did some changes. I cant figure out what I have done to fix it.
My site was working properly but suddenly some issues come out.
1- 2 javascript menus do not work
2- tags in my language Greek do not work
example
mysite.com/tags/iphone/ works just fine
mysite.com/tags/%F3%F7%DD%F3%E5%E9%F2/ does not work anymore
3- even the WHM login has changed and the pop-up window with login info dows not load anymore
I assume that some changes were done to security options in the server configuration but I can find it.
I have just made a scan through WHM and the result was:
Possible Trojan - /usr/bin/xmlcatalog
Possible Trojan - /usr/bin/xmllint
Possible Trojan - /usr/bin/xml2-config
Possible Trojan - /usr/lib64/python2.4/site-packages/libxml2mod.la
Possible Trojan - /usr/lib64/python2.4/site-packages/libxml2mod.so
Possible Trojan - /usr/bin/xml2-config
Possible Trojan - /usr/sbin/pureauth
Possible Trojan - /usr/sbin/antirelayd
Possible Trojan - /usr/bin/cpan
Possible Trojan - /usr/bin/instmodsh
Possible Trojan - /usr/bin/prove
Possible Trojan - /etc/cron.daily/logrotate
12 POSSIBLE Trojans Detected
Also the Mod Security in WHM gives me a warning about the tags in Greek that use % symbols in the url..
Can anyone give me a clue about it?
thanks
