[CentOS] Linux Zombie Web Servers

Linked below are details about a new outbreak of hijacked linux web servers that dispense malware.

http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-...

I would highly recommend that you use nmap to scan all your Linux webservers that are connected to the Internet to see if they are listening on port 8080.

The best I can tell, there are no articles concerning how these guys installed nginx or what is contained on a machine that has been compromised. But the best way to tell is to see if you are listening on port 8080 (if you are not supposed to be listening there). 8080 is a common port for java apps to be running on, so listening on 8080 is not always necessarily bad.

Thanks, Johnny Hughes