• Dear Pleskians! The Plesk Forum will be undergoing scheduled maintenance on Monday, 7th of July, at 9:00 AM UTC. The expected maintenance window is 2 hours.
    Thank you in advance for your patience and understanding on the matter.

Hacked? Need help ...

G

graffix

Guest
Hello,

we have running Plesk 7.5.3 on a Fedora Core 2 Box.
Today i see under ps axu the following process:

/usr/sbin/-e

What is that?

I look in the process list over webmin, and i see that the connections to:

/home/..../customersite/httppdocs/CHATPROGRAMM

Than to root -> /usr/sbin/httpd

Than is follwing connections and open files tto /libs and so on.

Any idea?

Thanks
 
Someone has exploited your system, Id say its a bot, web shell, etc. Something like that. Looks like they compromised the system through a web application
 
Have seen this from a user using a hacked script / warez software... is becoming common with hacked scripts to have keyloggers, and backdoors in them.

Have all users edit every part of their hacked scripts and stolen software and check for suspicous coded email addresses and keyloggers.
 
Back
Top