One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. What would be our next steps, and what what could the potential impact be of having psybnc installed?
I personally do not have access to the servers in question, but have been asked to provide input on the situation.
PsyBNC is an IRC bouncer, i.e. a program meant to relay communications for the IRC chat network. By itself, it is pretty benign; it uses part of your CPU and bandwidth, and might be used as an indirect tool for relaying data or mounting attacks of questionable legality.
The real question is: since installing and launching this program requires administrative rights on your server, whoever did it could have done a lot more things. So, what did he do ?
The potential impact is that this unidentified individual installed other tools, e.g. a rootkit, meaning that he can come back at will and totally control the machine; no data on it is safe, and the machine can then be used in various nefarious schemes which could be very embarrassing for you (up to and including plunging you into deep legal trouble -- in a kind-of worst case scenario where the attacker is part of Al-Qaida and brings your machine to the attention of the CIA). As a basic rule, if your machine is rootkitted, then it no longer is your machine.
Therefore, the prudent course is to reformat the machine and resinstall it from scratch. All your backups are suspect, too.
Nuke, nuke, nuke from orbit
Cleanse it with fire
Kill, kill, kill all the bits
Lest things become dire
