So I have a clients server that is infected with malware. Basically any index.php file on the server was infected as well as header.php, function.php. The infection seems to be primarily wordpress sites although other types of sites reside on the account as well.  The hack seems to generate some type of a "key" in a file called ".." That file, even though it gets deleted, returns within in a few minutes. (probably 10 or 15 minutes). I've gone ahead and cleaned all the infected files I've found with some scripting.  Here's my question, I am presuming that if I can find the file(s) that are respawning the ".." file(s) back on the server, I am thinking it will lead me to the source of the infection as well. But what I'd like to know is, how can I actually track that down?  I was thinking maybe tailing the logs in SSH or something to see if that would show me something, but I am not quite sure. I know I'd like to find the infection point and get it removed before I have to do a complete reclean of the server. Right now - I'm just baby sitting respawned ".." files.  Any thoughts on how I can dig this out?
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
Trying to identify a story about breaking out of a predefined path and no one notices I vaguely remember reading a short story many years ago where something happens and the protagonist gets a bit "out of step" with the rest of the world.  Everyone else keeps acting as if he's still doing what he would have been doing before the event, to the point of carrying on one-sided conversations and the like.  I can't remember much of the plot, but the premise stuck with me.  Edit: To try and explain it more clearly, based on the comment I just wrote, I think everyone else was effectively acting like they were robots with a prerecorded program.  If someone would normally wake up, drink coffee, put on pants, then walk out the door to catch a bus, then if the protagonist broke his coffee cup, stole his pants, and jammed the door, the victim would pour coffee into a broken/nonexistent cup, walk out pantsless, but when he got to the jammed door he might suddenly realize something was up (and thus being "out of step" spreads) or he might continue to go through the motions.  In either case, no one else would notice that the victim was pantsless (or that he didn't make it to work)...  How much of this actually came up in the story, I don't remember. What's a good Windows RDP client for Mac? I administer a number of Windows machines, and am trying to find a really good application to remote desktop in to them from my Mac.  I've tried CoRD, and I really like its library approach to saved sessions (as opposed to Microsoft's file based approach), and tabbed sessions are great when working on a bunch of machines.  Unfortunately, it's just too buggy for serious use, and given that it averages less than 2 releases a year, I have little hope that that will change.  Microsoft's official client is very bare bones and doesn't support connecting on non-standard ports (which I need).  Is there a remote desktop client for Mac out there that's both fully featured and not buggy?  Edit: Apparently the Microsoft doc I read that states that the Microsoft RDC client can't be used on non-standard ports is out of date. Visual Studio Solutions Folder as real Folders I have a Visual Studio Solution. Currently, it is an empty solution (=no projects) and I have added a few solution folders.  Solution Folders only seem to be "virtual folders", because they are not really created in the Filesystem and files inside solution folders are just sitting in the same folder as the .sln file.  Is there a setting that i've overlooked that tells Visual Studio to treat Solution Folders as "real" folders, that is to create them in the file system and move files into it when I move them inside the solution into one of those folders?  Edit: Thanks. Going to make a suggestion for VS2010 then :) In this kind of sentence the second half is an inversion of the first half. Is it a rhetorical artífice? What kind? When Ron broke his wand, why didn't he apply for Hogwarts financial aid? Difference between regex [A-z] and [a-zA-Z] Gnome keyring daemon not starting up properly Following , I would like to know what exactly it means for a tag to be marked as blocked (formerly blacklisted) on a Stack Exchange site.  Does it mean I can't use that tag on my question? What are the reasons for blocking a tag? Who can block tags? Why am I being prompted to remove a tag from a question I'm editing? I estimated the sample covariance matrix $C$ of a sample and get a symmetric matrix. With $C$, I would like to create $n$-variate normal distributed r.n. but therefore I need the Cholesky decomposition of $C$. What should I do if $C$ is not positive definite? I have the following equation, where there is a lot of stuff under the sum symbol:  \begin{equation} d(\vec{x},\vec{y})=   \sum_{Z_{xy}\in\vec{Z}_{xy},\forall x\in\vec{x},\forall y\in\vec{y}}      f(Z_{xy}) \end{equation}   In the resulting document, I find it kind of hard to read. Is there a way to write the equation to make the result more readable, e.g. putting the stuff under the sum symbol on different lines? How did the Swooping Evil Venom infused rain affect the magical community? I didn't see any wizards drenched in the rain at the end of Fantastic Beasts and Where to Find Them (don't recall, actually). But would the rain equally affect the wizards as it did no-maj's?   This event is something that doesn't necessarily need to be forgotten by the Wizarding community. How would they avoid being obliviated by the rain?  (They could avoid the rain by Apparating, but what about the showers and drinking water?)  This question is picking at my brain. Coloring specific elements of sets with a prime modified order in an array plot A toplogical space $X$ is said to be second countable   if there exists a countable basis for the topology.      $X$ is separable if there exist a countable dense subset.   Show that a second countable space always is separable.      Give an example of a space that is separable but not    second countable   The first part was easy and i managed to solve it on my own  Assume that $X$ is second countable and let $B_1, B_2, B_3...$ be a countable basis. Construct the set $A$ by taking one element $x_n$ out of every $B_n$. Then $A$ becomes dense because every open set $U$ contain a $B_n$ which in turn contain the element $x_n$ in $A$.    Again, like in the question i posted yesterday, i had trouble to come up with an example but our professor gave an example during the last lecture but i dont fully understand it:  "For an example of a separable but not second countable space let $X$ be the real line provided with the cofinite topology, i.e. where a set is open if its either empty or if its complement is finite.   Then every infinite set is dense and hence $X$ is separable.  But for an arbitrary countable family of open sets $U_1, U_2...$ write $U_i = X$\ $A_i$, where $A_i$ is finite, there is an element $x \in X$\ $(\cup_i Ai)$, because $A_i$ is countable,  such that the open set $X$\ $\{x\}$ is then not able to contain any $U_i$. Consequently $X$ is not second countable."  We asked him to explain it in more detail but his english is poor and nobody understood anything...:)       Def: A subset $A$ of a topological space $X$ is dense in $X$ if for any point $x$ in $X$, any neighborhood of $x$ contains at least one point from $A$.   $1.$ "Then every infinite set is dense"  Take $A$ to be one of these infinite sets. If $x \in A \subset X$ then it trivially fulfills the definition. But if we take a $x \not\in A$ why is it not possible to find a neighborhood in these finite sets that does not contain an element in $A$?  edit: its obvious if it is only open neighborhoods, open sets in the topology, but that is not specified in the definition.  $2.$ I am not fully understanding this either  "But for an arbitrary countable family of open sets $U_1, U_2...$ write $U_i = X$\ $A_i$, where $A_i$ is finite, there is an element $x \in X$\ $(\cup_i Ai)$, because $A_i$ is countable,  such that the open set $X$\ $\{x\}$ is then not able to contain any $U_i$. Consequently $X$ is not second countable."  Is it possible to express this in a simpler way? Java Command line arguments I am trying to detect whether the 'a' was entered as the first string argument. Given an alphabet of size $n$, how many strings of length $c$ contain every single letter of the alphabet at least once?  I first attempted to use a recurrence relation to work it out:  $$ T(c) = \left\{ \begin{array}{cr} 0 &amp;\mbox{ if $c&lt;n$} \\ n! &amp;\mbox{ if $c = n$} \\ T(c-1) \cdot n \cdot c &amp;\mbox{ if $c &gt; n$} \end{array} \right. $$  As there's no strings that contain every letter if c &lt; n, and if c = n then it's just all permutations. When c > n you can take any string of size (c-1) that contains all letters (of which there are $T(c-1)$ to choose from), you choose which letter to add (of which there are $n$ choices) and there are $c$ different positions to put it. However, this gives out results that are larger than $n^c$ (the total number of strings), so it can't be right, and I realised it was because you could count some strings multiple times, as you can make them taking different inserting steps.   Then I thought about being simpler: you choose n positions in the string, put each letter of the alphabet in one of those positions, then let the rest of the string be anything:  $$ {c\choose{n}} \cdot n! \cdot n^{c-n} $$  But again this counts strings multiple times.  I've also considered using multinomial coefficients, but as we don't know how many times each letter appears in the string it seems unlikely they would be much help. I've also tried several other methods, some complicated and some simple, but none of them seem to work.  How would you go about working out a formula for this? I'm sure there's something simple that I'm missing. How can I add a Login link to the "Main navigation" menu?  When a user clicks on the link, it should take them to the /user/login page. Once they login, the link should change to say "Logout" instead of "Login".  Is there any way to add such a link? How to flag a typo question I came across  today. In reading the answer and the comments it turns out that the issue was just a simple typo that the OP made. So that being the case I decided that this question probably needs to be closed since this will not be helpful to any future vistors. However, in looking at the flag reasons (I don't have the close ability yet), I don't see a flag that would be appropriate.   I know some of these options might still be influx because of the . However, until a different off-topic flag description is created, how should this be flagged? Or should this not be flagged at all and just allowed to live on or wait for a user with close votes to use a custom off-topic close option? Sharing a Bluetooth Keyboard and Mouse sequentially between two Macs I work out of my house where I have two computers: a mid-2010 Macbook Pro (for my day job) and a mid-2010 iMac (personal). During the workday, my iMac acts as a second display for my Macbook Pro via Mini Displayport.  Currently, I use a USB keyboard and mouse for my work computer and a Bluetooth keyboard and Magic Mouse + Magic Trackpad for use with my personal computer. I'd like to get rid of the wired keyboard and mouse and just use the Bluetooth stuff for both machines (but never simultaneously).   Is it possible to easily share the single set of input devices without having to repeatedly break and reestablish the pairing of the input device to the correct computer? I'm not opposed to buying some type of additional hardware to accomplish this, provided it's not prohibitively costly or cumbersome to use or configure.  It's not clear to me how I would tell the MacBook Pro to leave the devices alone so the iMac can have them for the evening. I want to avoid de-pairing and re-pairing the devices each time I want to shift them back or forth.  Basically is there software or hardware that works as a Bluetooth KVM switch? Is $f(x)=10$ a periodic function? sudo apt upgrade error 18.04 (Broken Packages)