Re: [ilugd] Server is hacked, pl. advice

2010-12-14 Thread Sandip Bhattacharya
On Fri, Dec 03, 2010 at 02:52:51PM +, Karanbir Singh wrote: On 12/03/2010 06:26 AM, abhishek jain wrote: can anyone here suggest me what should i do, i am not sure how user1 logged into server, further what does the command perl udp.pl 92.114.6.32 0 22 mean which eats up 99.7% of CPU .

Re: [ilugd] Server is hacked, pl. advice

2010-12-13 Thread Arun Khan
On Sat, Dec 11, 2010 at 11:41 AM, Aman Thakur aman.thakur.1...@gmail.com wrote: So just backup you data, only data and reinstall your system. And update your system with the latest security updates. Even if you succeed fixing this system, even then there are chances for the system to be

Re: [ilugd] Server is hacked, pl. advice

2010-12-10 Thread Aman Thakur
Hi abhishek, I agree with the guys who are supporting a reinstall here. Even my linux (RHEL 5.5) Virtual machine was compromised once because i didn't updated it regularly. Someone gained root access to my machine. I tried so many things at that time. But finally there was only one solution and

Re: [ilugd] Server is hacked, pl. advice

2010-12-08 Thread abhishek jain
hi, This is christmas / season time and clean install is not possible as there will be downtime, i will have to wait for this until mid jan, On Tue, Dec 7, 2010 at 10:11 PM, Ravi Kumar ra2...@gmail.com wrote: Because we cannot remember the state of files, and cannot be 100% sure that no

Re: [ilugd] Server is hacked, pl. advice

2010-12-08 Thread Sudhanwa Jogalekar
On Wed, Dec 8, 2010 at 3:17 PM, abhishek jain abhishek.netj...@gmail.com wrote: hi, This is christmas / season time and clean install is not possible as there will be downtime, i will have to wait for this until mid jan, On Tue, Dec 7, 2010 at 10:11 PM, Ravi Kumar ra2...@gmail.com wrote:

Re: [ilugd] Server is hacked, pl. advice

2010-12-08 Thread homicide
well if you cant afford to have a down time you need to do few more thing then what other gurus have said like below : - 1) set up logwatch to have full server log for any traffic 2) get CSF ( config server firewall ) and install as it s having plugin for both Cpanel Webmin 3)

Re: [ilugd] Server is hacked, pl. advice

2010-12-08 Thread kuldeep kamboj
Well thanks for all the replies. I face only some other hardware or software problems on linux till now. So i was thinking that idea of reinstall is strange. On Dec 8, 2010 10:49 AM, jeet7668 . jeet7...@sify.com wrote: Hi Kuldeep, I totally agree with Sudhwna that its easier to reinstall then

Re: [ilugd] Server is hacked, pl. advice

2010-12-07 Thread kuldeep kamboj
Hi mr raj mathur, Im just very new to linux, so please dont mind about my question. But reinstall of linux in case of hack dont look very good solution. Even in case of windows we first try to recover system not to reinstall. Then how can be justified to reinstall linux system in case of hack like

Re: [ilugd] Server is hacked, pl. advice

2010-12-07 Thread Ravi Kumar
Because we cannot remember the state of files, and cannot be 100% sure that no rootkit or other exploits is left in some corner of server. we can re-install the whole linux if we want. This is not a compulsion, but an advice to have a clean install. -=Ravi=- On Tue, Dec 7, 2010 at 9:40 PM,

Re: [ilugd] Server is hacked, pl. advice

2010-12-07 Thread Sudhanwa Jogalekar
Dear Kuldeep, Starting with a clean OS is always better. You are sure about the things you have installed and working for you. In the current scenario where there are many things running without authorization, there could be some traces of the same even if those things are stopped, cleaned.

Re: [ilugd] Server is hacked, pl. advice

2010-12-07 Thread jeet7668 .
Hi Kuldeep, I totally agree with Sudhwna that its easier to reinstall then to struggle hard to clean the the system but for any reason if you cannot re-install and u have to fix the same one then you can use some tools like ballistic and others to judge the current state and try to find out the

Re: [ilugd] Server is hacked, pl. advice

2010-12-03 Thread Naresh Narang
I today noticed my VPS was running too slow, then i logged into root , and found a lot of load on it ( 240 ). I did a ps -ef and a lot of process were running, a lot of them were user1     23771     1  0 15:36 pts/0    00:00:02 ./atack 800 Also in WHM i see a process user1 99.7 perl udp.pl

Re: [ilugd] Server is hacked, pl. advice

2010-12-03 Thread Raj Mathur (राज माथुर)
On Friday 03 Dec 2010, abhishek jain wrote: hi friends, I today noticed my VPS was running too slow, then i logged into root , and found a lot of load on it ( 240 ). I did a ps -ef and a lot of process were running, a lot of them were user1 23771 1 0 15:36 pts/000:00:02

Re: [ilugd] Server is hacked, pl. advice

2010-12-03 Thread Karanbir Singh
On 12/03/2010 06:26 AM, abhishek jain wrote: can anyone here suggest me what should i do, i am not sure how user1 logged into server, further what does the command perl udp.pl 92.114.6.32 0 22 mean which eats up 99.7% of CPU . You have already had a lot of good advice here, I'll add a few

[ilugd] Server is hacked, pl. advice

2010-12-02 Thread abhishek jain
hi friends, I today noticed my VPS was running too slow, then i logged into root , and found a lot of load on it ( 240 ). I did a ps -ef and a lot of process were running, a lot of them were user1 23771 1 0 15:36 pts/000:00:02 ./atack 800 Also in WHM i see a process user1 99.7

Re: [ilugd] Server is hacked, pl. advice

2010-12-02 Thread Anshul Chauhan
hi, kill all the process by user1, delete user1 if possible or change its password and check the users home directory if their is some script found and check its contents and see where all it has made changes. Warm Regards, Anshul Chauhan Never expect things to happen struggle make them

Re: [ilugd] Server is hacked, pl. advice

2010-12-02 Thread Vivek Kapoor
On 12/03/2010 11:56 AM, abhishek jain abhishek.netj...@gmail.com wrote: hi friends, I today noticed my VPS was running too slow, then i logged into root , and found a lot of load on it ( 240 ). I did a ps -ef and a lot of process were running, a lot of them were user1 23771 1 0 15:36

Re: [ilugd] Server is hacked, pl. advice

2010-12-02 Thread Sagar Belure
Hi, On Fri, Dec 3, 2010 at 11:56 AM, abhishek jain abhishek.netj...@gmail.comwrote: hi friends, I today noticed my VPS was running too slow, then i logged into root , and found a lot of load on it ( 240 ). I did a ps -ef and a lot of process were running, a lot of them were user1