Thanks a lot to everyone who help me to solve the problem.
I had installed phpmyadmin and they used it to attack my server.
I found this in /var/log/httpd/access_log
Cheers
Luisa
Date: Fri, 13 Jan 2012 15:32:55 -0500
To: users@httpd.apache.org
From: storm...@stormy.ca
Subject: Re: [users@httpd] attack on apache - solved -
At 04:48 PM 1/13/2012 -0300, you wrote:
Thanks a lot to everyone who help me to solve the problem.
I had installed phpmyadmin and they
On Mon, Jan 9, 2012 at 5:20 PM, Luisa Ester Navarro
luisa2...@hotmail.com wrote:
I didn´t have any cronjobs but when I detected the attack I saw one in
/var/spool/cron
My logifle says
User apache:
/var/tmp/.autorun/update /dev/null 21
Date: Wed, 11 Jan 2012 21:13:53 +0100
From: jer...@adaptr.nl
To: users@httpd.apache.org
Subject: Re: [users@httpd] attack on apache
On 01/11/2012 09:10 PM, Jaco Kroon wrote:
On 11/01/12 21:35, Jeroen Geilman wrote:
you reject my messages
. Is this the problem ? or are
there another thing that I dont know
Thank again
2012/1/9 Marcin 'Rambo' Roguski ra...@id.uw.edu.pl
On Mon, 9 Jan 2012 09:13:09 -0300
Luisa Ester Navarro luisaester2...@gmail.com wrote:
you reject my messages
Apparently not
--
Marcin 'Rambo' Roguski ra...@id.uw.edu.pl
My server is being attacked. I think it is from apache because I have found
commands running with the owner apache.
My httpd is on /usr/sbin and they run on /usr/local/apache/bin/httpd -DSFSL
and sh -c curl -o http
They also run every minutes a crontab from /var/spool/cron and I din´t
replaced: 1 Time(s)Thanks
Date: Mon, 9 Jan 2012 18:05:38 +0100
From: i...@simonecaruso.com
To: users@httpd.apache.org
CC: luisa2...@hotmail.com
Subject: Re: [users@httpd] attack on apache
On 09/01/2012 16:11, Luisa Ester Navarro wrote:
My server is being attacked. I think it is from apache
