1 reputation
12
bio website linkandzelda.com
location
age
visits member for 2 years, 2 months
seen Oct 11 '12 at 10:01

Aug
26
awarded  Notable Question
Aug
27
awarded  Popular Question
Oct
11
awarded  Editor
Oct
11
revised WHM server hacked, lost root access
added 2 characters in body
Oct
11
comment WHM server hacked, lost root access
Ok, I booted to single user mode and was able to reset my password from there. Now I have root access back, but only for 5-10 mins as it gets changed again right after booting up. I scanned for rootkits and found nothing, and am doing a clamav scan which isnt bringing up much either. Luckily I connected to root SSH terminal right before it got changed, so I have no WHM access but I do have SSH root access until I disconnect.
Oct
11
comment WHM server hacked, lost root access
That's what is seems indeed.
Oct
11
comment WHM server hacked, lost root access
I SSHed in as another user and am unable to use su and sudo to gain any root access, "not in sudoers file".
Oct
11
comment WHM server hacked, lost root access
Thanks, though my root account password does not work, so something must of happened no? The other thing is, I did an account transfer from another server to this one only 2 days ago, and the other server was "taken over" in the sense that the email was changed to mine and nameservers swapped/changed. Might be some indicator might not.
Oct
10
comment WHM server hacked, lost root access
This is what I considered, making a new VPS and restoring data onto it.
Oct
10
comment WHM server hacked, lost root access
Oh, and it's not managed I was the one that setup everything.
Oct
10
comment WHM server hacked, lost root access
It's a VPS running on a OVH dedicated server which Xen. The process was.. /usr/local/apache/bin/httpd -k start -DSSL It brings up the HackedMachineExample on OVH when googled.
Oct
10
asked WHM server hacked, lost root access