<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi Everyone,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The server we are running is Blueonyx 5108R<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Three days ago, we saw suspected files under<o:p></o:p></p><p class=MsoNormal>/tmp/css.jpg<o:p></o:p></p><p class=MsoNormal>/tmp/unix.jpg<o:p></o:p></p><p class=MsoNormal>/tmp/akas.jpg<o:p></o:p></p><p class=MsoNormal>/tmp/akas.php<o:p></o:p></p><p class=MsoNormal>/tmp/ramz.php<o:p></o:p></p><p class=MsoNormal>/tmp/java-site.php<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>and other files under one of the wordpress site.<o:p></o:p></p><p class=MsoNormal>/home/.sites/56/site60/web/wp-content/themes/kingsize/cache/f240a370b9924474e0c45220fcc2bccb.jpg<o:p></o:p></p><p class=MsoNormal>/home/.sites/56/site60/web/wp-content/themes/kingsize/cache/f4ddcb6280e8951d6ca2102851d8632f.jpg<o:p></o:p></p><p class=MsoNormal>/home/.sites/56/site60/web/wp-content/themes/kingsize/cache/read.php<o:p></o:p></p><p class=MsoNormal>/home/.sites/56/site60/web/wp-content/themes/kingsize/cache/xx.php<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Virus Scanner pick them up as Backdoor:Perl/Shellbot and have removed the above files and suspected backdoor entry was through wordpress. So, to avoid future attacks we have implement .htaccess file to limit specific IP address to access the wp-login.php as mentioned in <a href="http://forums.whirlpool.net.au/forum-replies.cfm?t=2085205">http://forums.whirlpool.net.au/forum-replies.cfm?t=2085205</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Today again we are seeing same files re-appear. We have removed those files again. But don’t know how they are getting in?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Has anyone seen this before and have a solution? Or point us to right direction?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So far,<o:p></o:p></p><p class=MsoNormal>Scanning FTP, HTTP, Mail Log looks clean. <o:p></o:p></p><p class=MsoNormal>Server SSH access is limited to limited static IP address.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>Samy<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='color:#C00000;mso-fareast-language:EN-AU'>Senthil Ramasamy,<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-size:10.0pt;mso-fareast-language:EN-AU'>Sr. Technical Manager | <b><span style='color:#C0504D'>Maxi Internet Services,</span> <o:p></o:p></b></span></p><p class=MsoNormal><span style='font-size:10.0pt;mso-fareast-language:EN-AU'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;mso-fareast-language:EN-AU'>Suite 22, 36 East Street,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;mso-fareast-language:EN-AU'>Five Dock, NSW 2046.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;mso-fareast-language:EN-AU'>T: 02 9713 4066 | F: 02 9713 4077<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;mso-fareast-language:EN-AU'>M: 0434 484 577 | W: maxi.net.au<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>