We are happy to announce that Vesta is back under active development as of 25 February 2024. We are working on v1 candidate and expect to engage more with the community over the coming months. We are committed to open source, and we encourage contributors to help us build the future of Vesta.
HACKED AGAIN HELP
HACKED AGAIN HELP
Hi now my other server on vestacp is hacked and this time it is different.
Like I tried removing the whole domain all files gets deleted then some files keep coming back with obvious malicious codes in them..
Tried deleting with ssh still come back...
Any idea how can i track this to remove it, changed all passwords already
Like I tried removing the whole domain all files gets deleted then some files keep coming back with obvious malicious codes in them..
Tried deleting with ssh still come back...
Any idea how can i track this to remove it, changed all passwords already
-
- Support team
- Posts: 1111
- Joined: Tue Jul 30, 2013 10:18 pm
- Contact:
- Os: CentOS 6x
- Web: nginx + php-fpm
Re: HACKED AGAIN HELP
Did you use Wordpress?
Re: HACKED AGAIN HELP
1. Double check your file access rights
2. You could try this A/V scanner cmd:
3. tighten your security with https://cisofy.com/lynis/
Tutorial: https://www.digitalocean.com/community/ ... untu-16-04
4. Maybe have backups (as VestaCP makes them) Try that.
However if you're site is compromised on a files and/or content level? It means -- in most cases -- you're f*cked.
5. Really like to go over things before you put them live? Create a XAMPP / WAMP / MAMP local environment.
2. You could try this A/V scanner cmd:
Code: Select all
clamscan -r -i /home
Tutorial: https://www.digitalocean.com/community/ ... untu-16-04
4. Maybe have backups (as VestaCP makes them) Try that.
However if you're site is compromised on a files and/or content level? It means -- in most cases -- you're f*cked.
5. Really like to go over things before you put them live? Create a XAMPP / WAMP / MAMP local environment.
Re: HACKED AGAIN HELP
I think that the main problems is file and folder perrmisons...What are they ?
-
- Posts: 3
- Joined: Thu Feb 14, 2019 6:11 pm
- Os: CentOS 6x
- Web: apache + nginx
Re: HACKED AGAIN HELP
Are you using private key login to vps ?wyamout wrote: ↑Fri Jan 25, 2019 10:14 amHi now my other server on vestacp is hacked and this time it is different.
Like I tried removing the whole domain all files gets deleted then some files keep coming back with obvious malicious codes in them..
Tried deleting with ssh still come back...
Any idea how can i track this to remove it, changed all passwords already