Kryptronic Software Support Forum

I had the following message from my server company, I have changed password etc, but unsure how it got exploited, I last updated the software probably 4 months back, is there anything else I need to do here?

Thanks



This ticket is being created to discuss the below account with you. During a routine daily scan of this server we have identified file(s) within the account that appear to be compromised, based upon MD5 file hashes and HEX pattern matches of currently known exploits.

We have detailed any action taken by ourselves and included as much relevant information as possible below. It would be appreciated if you could urgently review this report and inform us that you are investigating. We kindly ask you to acknowledge this ticket within the next 24 hours, as a lack of response may result in the website being suspended.


List Of Exploited Files:
=========================================================================
{HEX}perl.generic.fakeproc.49 : /home/moy29/public_html/downloads/error/error.log => /usr/local/maldetect/quarantine/error.log.28374
=========================================================================

Action(s) Taken:
=========================================================================
The offending files have been quarantined
=========================================================================

Typically we see exploited files in accounts that are running out-dated and insecure versions of web scripts and modules/components of these scripts. We additionally see these files in accounts that have weak passwords, insecure file permissions and connecting computers that have been compromised themselves.

In an effort to remedy any unknown harm that has been done, and to protect against future exploits, we highly recommended the following actions:

* Immediate change of all passwords associated with this account
* Auditing of the account (old scripts, unknown files, etc)
* Ensure web scripts and associated modules/plugins are up-to-date and secure
* Performing security sweeps of any computer systems that connect to this account