Maybe Hack

[lhuggins]

I am using v2.2rc2 and have implemented most of the security fixes. I have subscribed to google alerts using my web site to alert to. I just got this alert and I do not know what it is or where it came from;

 

May 20 13:23:14 p3nlhftpg025 [11240]: ([email protected]) [iNFO] lhuggins is now logged in

May 20 20:23:16 p3nlhftpg025 [11240]: ([email protected]) [iNFO] Logout.

May 20 13:24:23 p3nlhftpg025 [11455]: ([email protected]) [iNFO] lhuggins is now logged in

May 20 20:24:24 p3nlhftpg025 [11455]: ([email protected]) [NOTICE] File successfully renamed or moved: [.htaccess]->[.htaccess9]

May 20 20:24:25 p3nlhftpg025 [11455]: ([email protected]) [NOTICE] /home/content/50/5607150/html//23788624linux_db_test.php uploaded (861 bytes, 5.54KB/sec)

May 20 20:24:26 p3nlhftpg025 [11455]: ([email protected]) [NOTICE] Deleted 23788624linux_db_test.php

May 20 20:24:26 p3nlhftpg025 [11455]: ([email protected]) [NOTICE] File successfully renamed or moved: [.htaccess9]->[.htaccess]

May 20 20:24:26 p3nlhftpg025 [11455]: ([email protected]) [iNFO] Logout.

May 20 13:26:52 p3nlhftpg025 [11939]: ([email protected]) [iNFO] lhuggins is now logged in

May 20 20:26:52 p3nlhftpg025 [11939]: ([email protected]) [iNFO] Logout.

May 20 13:26:58 p3nlhftpg025 [11959]: ([email protected]) [iNFO] lhuggins is now logged in

May 20 20:26:59 p3nlhftpg025 [11959]: ([email protected]) [iNFO] Logout.

May 20 13:27:01 p3nlhftpg025 [11965]: ([email protected]) [iNFO] lhuggins is now logged in

May 20 20:27:01 p3nlhftpg025 [11965]: ([email protected]) [iNFO] Logout.

[burt]

If you do not recognise them, then you should be worried. It is possible that you have something set up automatically, eg a db backup via cron, but that should not be changing the name of a .htaccess file.

 

Possible hacking activity.