1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

Hacked? Need help ...

Discussion in 'Plesk for Linux - 8.x and Older' started by graffix, Jul 16, 2005.

  1. graffix

    graffix Guest


    we have running Plesk 7.5.3 on a Fedora Core 2 Box.
    Today i see under ps axu the following process:


    What is that?

    I look in the process list over webmin, and i see that the connections to:


    Than to root -> /usr/sbin/httpd

    Than is follwing connections and open files tto /libs and so on.

    Any idea?

  2. atomicturtle

    atomicturtle Golden Pleskian

    Nov 20, 2002
    Likes Received:
    Washington, DC
    Someone has exploited your system, Id say its a bot, web shell, etc. Something like that. Looks like they compromised the system through a web application
  3. MrBafner

    MrBafner Guest

    Have seen this from a user using a hacked script / warez software... is becoming common with hacked scripts to have keyloggers, and backdoors in them.

    Have all users edit every part of their hacked scripts and stolen software and check for suspicous coded email addresses and keyloggers.
  4. AlbertS

    AlbertS Guest

    if ur the one who made


    I ques my system is not safe asswell?


    EDIT (..)
    Ques ur not the one who made that howto.. U should read it, and preform it on ur systems.. Works verry good without much effort.