Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of my servers just had the memory exhausted by a load of Perl scripts, we use plesk and they seem to have appeared under the /var/www/vhosts/ directory, I managed to stop all of the processes and delete the scripts but I have absolutely no idea how they would've got there.

Can someone point me in the right direction in order to prevent further attacks?

share|improve this question

closed as not a real question by Rory Alsop Mar 5 '12 at 11:18

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Hi Frank - unfortunately this question is unanswerable in its current form. Without knowing your environment, your current security controls etc., there are a huge number of possible attack routes. Have a look at as an example. If you think you can provide more info, edit the question and we may be able to reopen. – Rory Alsop Mar 5 '12 at 11:18
You need to figure out the source of the scripts in order for us to help. I suggest locking down the server. – Ramhound Mar 5 '12 at 19:56
There's a notable chance this is something to do with the recentish vulnerability that allows unauthenticated remote users to call agent.php and achieve anything plesk can do… – Cheekysoft Mar 13 '12 at 13:53
See also… – Cheekysoft Mar 13 '12 at 14:15

Browse other questions tagged or ask your own question.