need FreeBSD help - servers been hacked!

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • rickdu
    Confirmed User
    • Mar 2005
    • 239
    #1

    need FreeBSD help - servers been hacked!

    tech support @ my provider can't help at all.. i won't even go into how much i hate them.. what I do know is it's sending mass spam emails from somewhere that I can't locate so far.. im not sure what to do now, so any advice is appreciated.

    ICQ: 63-149-919
    Tags: None
    • rickdu
      Confirmed User
      • Mar 2005
      • 239
      #2
      if anyone is a web host and can help with this problem, i'll make the switch to your service next week. I'm still paid for 3 weeks with these people, but I'll switch next week if you can help

        Comment

        • lawked
          Confirmed User
          • Apr 2003
          • 354
          #3
          You're saying your machine is spamming and you don't know why?

          Open 2 sessions:

          netstat -w1

          Monitors how much your server is sending.

          netstat -an in another session... shows the network activety.

          sockstat - shows ports opened by software.

          It's probably related to a php script as FreeBSD is tight.

            Comment

            • prodiac
              Confirmed User
              • Sep 2003
              • 419
              #4
              Originally posted by rick702
              tech support @ my provider can't help at all.. i won't even go into how much i hate them.. what I do know is it's sending mass spam emails from somewhere that I can't locate so far.. im not sure what to do now, so any advice is appreciated.

              ICQ: 63-149-919
              ICQ'd you

                Comment

                • rickdu
                  Confirmed User
                  • Mar 2005
                  • 239
                  #5
                  Originally posted by lawked
                  It's probably related to a php script as FreeBSD is tight.
                  im hoping so.. i upgraded php from 4.3.6 to 4.3.11 and i HOPE that will help.. im not seeing anything being sent right now

                    Comment

                    • FireFoz
                      Confirmed User
                      • Apr 2002
                      • 480
                      #6
                      hey hit me up icq 6981021 i might be able to help you out ab it

                        Comment

                        • marketsmart
                          HOMICIDAL TROLL KILLER
                          • Dec 2004
                          • 20419
                          #7
                          You need to rebuild the box, unless you just have an open relay. My guess would be an open port that they gained access or hacked the box and created a relay. In the future hire someone to lockdown your machine. Close all unnecessary ports, make sure all directories have the right permissions and only allow specific IP's to come in remote for admin.

                          Although anything (like exploits or a simple admin mistake) can leave you open, most hackers are looking for easy access (they have plenty of other choices) and will not spend time on a pretty secured box.

                          My two cents....

                            Comment

                            • webair
                              Confirmed User
                              • Feb 2002
                              • 8531
                              #8
                              icq'd contact me


                              ~ Webair Dedicated Cloud Servers™ ~ WEBAIR VSYS™ Virtual Hosting Platform ~ Superior CDN Network ~
                              ~ Managed Dedicated hosting Specialists ~ DISCOUNT DOMAIN NAMES! ~ WEBAIR FUSION IO MANAGED CLOUD SERVERS! ~

                              ICQ: 243116321 - TWITTER - @WEBAIRINC - E-Mail: [email protected]

                                Comment

                                Previous template Next
                                Working...