Hey guys,

I have been having some issues with one of my servers for a while now, I thought I had it sorted but I came across a site on here where any file that are not assigned to root are being deleted.

Have you ever heard about this, is there something that I can check to find out where its coming from?

thanks

Assuming what you describe as happening, is actually occurring, in all likelihood, you've been compromised.

Only solution is to wipe your box clean, do a fresh install of OS and APPS, and restore your config/data from notes/backups.

_________________
Either provide enough details for people to help, or sit back and listen to the crickets chirp.
Security thru obscurity is a myth - and really really annoying.

nzmattman,
vonskippy is probably right - you may have been compromised. But, in the off chance that your server is the culprit, could you provide more information?
- specific examples of a file that was delete, when it was delete, etc.
- what you did to make you think that it was corrected (and why you chose that approach/action).
- a list of all cron jobs.
- a list of all user accounts.
- your OS, version, control panel software, etc.


MSJ

Hey guys / girls,

Sorry for the delay in reply.
I am thinking now that it defiantly is compromised.
I have found a lot of spam files and code that is defiantly not mine appearing in random folders and stuff.
I have decided to deploy a new linode and shut this one down