Problem about account been hacked

mariaasuka24

• February 05, 2015 08:54

Hello all! I saw a few threads on this put nothing there helped me. I saw that one of my accounts were compromised causing high server loads. I find some files such as in a new directory "log" with the file "error.php". I tried deleting it but it keeps reappearing. Meaning I run the rm -rf error.php command under root, then it appears the file to be removed but then I run ls -l and the file is back. I tried "chown", "chmod", chattr -i, etc. nothing seems to work. the output for chattr -i is "-----------e" not sure what that means Cpanel is not working either.

• 

  cPanelMichael

  • February 05, 2015 15:47

  Hello :) Your access level is listed as "Website Owner". However, based on your initial post, I assume you have root access to this server. The following thread answers a similar question: What log files to check after an account gets hacked/defaced? You should also review the "Security Advisor" option in WHM to ensure you are implementing configurations that allow for protection against common hacks. Thank you.

  0

Please sign in to leave a comment.