-1

Possible Duplicate:
My server's been hacked EMERGENCY

Our client VPN Server got hacked, we change the password and FTP but it keeping happening every day now :( , Has any on had a hacked message like the "Hacked By ENES" visit "essexdrugaction[dot]org" to see what i mean.

Any help would be most appreciated.

Community
  • 1
John Doe
  • 29
  • 2
  • Can't help you if we don't have any facts. What web sites are you running? How are they configured? Are they fully patched and up to date? – Rushyo Aug 03 '12 at 12:02
  • All the file keeps on getting deleted. – John Doe Aug 03 '12 at 12:02
  • 7
    Burn it down, rebuild it with backup. This is the only valid answer you will receive here. – DanBig Aug 03 '12 at 12:08
  • the site is essexdrugaction.org, as for configs I have no clue i have never touch a VPN server before – John Doe Aug 03 '12 at 12:09
  • Take the hacked server offline, make a full backup for later analyses (So you know how did they got in). Reformat. Install a clean OS, update the OS and used programs. Only then restore data from backup and bring the server back on-line. – Hennes Aug 03 '12 at 12:13
  • I'm not even meant to know about this, the guy who set up everything left the company. The site is hosted by a 3rd party company, who are not being helpful at all. They have logs, but they're too "occupied" to check. My boss told our client get rid of the VPN hosting 3rd party, and move to our server instead. – John Doe Aug 03 '12 at 12:38

1 Answers1

5

Kill it, kill it now.

Nuke it into orbit and rebuild it. There is no way of knowing you got everything they did to the server. Start fresh and reinstall your OS.

Bart De Vos
  • 17,761
  • 6
  • 62
  • 81