Raoul....the "root" domain is a custom site i had bought...i have taken the site down...because that is where i believe the infected file is....however i have no idea where inside all those folders it can be.....should i just backup these files, download them, and just delete the site's files from the server?....also...it is a managed server...and they keep telling me i am the only customer on this server that keeps getting these phishing attacks.....
If its a managed server they should be able to provide proof that it is coming from your files. It could be a vulnerability in the server that is allowing remote access.
If they got access to your server and have any knowledge they can do very tricky things, opening ports and binding shells to them, placing shells in image files / text files using .htaccess's to make them executable. The list goes on.
My suggestion would be to go through your apache error logs first looking for odd entries. This can usually lead to finding the whole they got in from. For instance in a recent server I had the pleasure of examining. I found the error log had a ton of:
/roundcube/
/rc/
/roundcube-mail/
type paths then it suddenly stopped, I found that roundcube was installed and had a recently published exploit allowing remote access and write permissions.
Next I would examine the access logs, this can be daunting but I would look for specific query strings:
search for ../ that is a common trick used in directory transversal vulnerabilities to travel the directory path without knowing the file structure, also look for call using POST to files you do not recognize or shouldn't have been called with the post method.
Lastly if you still can't find it, I would take a backup of all sites, then revert to a known good backup. Then once the phishing starts again take note of the timeline and investigate using that timeline.
Hope some of that is useful.
Cheers,
Jay
