Knowledgebase
Portal Home > Knowledgebase > Articles Database > Possibly hacked?
Possibly hacked?
Posted by Itslee, 07-26-2011, 08:19 PM I tried to log into my WHM not long ago after logging out an hour before to find my password did not work. After adjusting my password and a few more attempts i had been locked out of my WHM. So i jumped onto my VPS control and shutdown my VPS to prevent anything happening. I then changed my VPS server password which changed my WHM password also? But i feel i was hacked as i had two emails telling me of failed logins. How can i check if i was hacked or someone gained access to my WHM. Edit: After logging into WHM i looked for any changes to whm, after clicking on to the name servers i was asked to log back into WHM. Which i tried and my password has been changed again! So im sure someone is in my WHM or vps! Ive also been locked out of WHM. Last edited by Itslee; 07-26-2011 at 08:24 PM.
Posted by Virtual6, 07-26-2011, 08:32 PM Do you have CSF installed if so lock out all IPs other than yours and see if the problem keeps occurring and then check through your logs.
Posted by lalog00, 07-26-2011, 10:41 PM If you don't feel confident of handling it you might want to pay for professional services. ConfigServer has services for compromised systems, take a look at their website.
Posted by whmcsguru, 07-27-2011, 07:33 PM It sounds like you were indeed hacked. Since this is a VPS, you're not totally screwed, you can just reload the OS, reload backups and be back in full swing. Obviously you want to figure out how you were hacked. Make sure when you reload everything that you're running the latest and greatest of everything, fire up rkhunter and chkrootkit, make sure they send you output daily, and keep up to date.
Add to Favourites 
Print this Article
Also Read
