my AVGfree system regales plesk threat and presence OK

my friends server was also hit via plesk,
through the filemanager, and % in the urls with the client ids

untill now i only found and removed js code from my indexes, php and html

but now i found an other variant, in the index they insert an include statement, to include an other file situated and looking like a log file.

then it is decoded and executed.

it is quite advanced coding, getting ads from some server, and lots of code to detect if its a googlebot or so, and then keep quiet

i found it out nearly by chance
(no i am not going to tell how i found it, it might help the hacker)

so, try to search for files around the infection date.

this one is not detected by a virusscanner
(dowload the code and run a scanner over it doesnt work)

hope this helps someone, dj

I speculate that the attackers may have obtained the passwords months ago and if the password were not reset they are simply returning to get into the system.

The latest round of attacks we see are on July 6th and 9th.

Plesk Panel 10.x for Linux…
- http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-linux-updates-release-notes.html
15-Jul-2012 – “… Fixed critical Plesk security issues found during internal security audit. All customers are highly recommended to update…”
.

- https://secunia.com/advisories/48262
.

Can you share with us some sample logs on how they grab the plesk passwords? I guess it will be much helpful for us in term of detection.