Several things may lead you to believe that access to your server has been compromised. These include:

  • Discovering unauthorized access following a log analysis.
  • Abnormal behaviour on your VPS (high CPU usage, large outgoing network traffic, abuse reports, outgoing spam, etc.)
  • A report from our technical support team
  • Something on your VPS that you do not recognise

As soon as any of these signs suggest your access has been compromised, you need to act very quickly to restore the situation. Actions generated by this compromised access can indeed be illegal (mass SPAM sending, use as a VPN, hosting phishing pages, DDoS attacks, etc.), or can make your server unusable (very high CPU usage, preventing your VPS from working normally.

If you are unable to reinstall the server right away, we recommend the following actions:

1/ Check running processes#

You can easily list running processes with the following command:

 root@Helpdesk:~# ps aux

You will then get the list of all active processes on the VPS. If some of them seem abnormal, you can easily check the path of the file in question to take the necessary actions.

You can also install the htop package, to see some information about your VPS, and sort processes by CPU usage.

 root@Helpdesk:~# apt-get install htoproot@Helpdesk:~# htop

You can quit HTOP by pressing F10 or Ctrl+C

2/ Run an antivirus scan on the VPS#

The "clamav" package lets you easily scan your VPS files for known malware or backdoors. It is very simple to use:

 root@Helpdesk:~# apt-get install clamavroot@Helpdesk:~# freshclamroot@Helpdesk:~# clamscan -r --bell -i /

This will launch a scan of all the files on the VPS, and will list the files considered dangerous. Note that this scan can take several minutes (or hours) depending on the amount of data on your VPS and your plan.

3/ Further secure your VPS#

We invite you to quickly follow our guide Strengthen the security of your VPS, in order to prevent further unauthorized access to your VPS.