Windows VPS - PLESK : security compromised - valid list of users

[Climar]

Hi,

Can somebody please post a list of valid users on a Windows PLESK solution?

We appear to have been hacked a few months back and there were a bunch of admin users setup.

I've gone through the list and washed it as best I can. There may be hidden users with usernames that look like they belong but they don't.

There are a bunch that had $ symbols at the end that i can't delete but i've removed from the admin group.

any assistance from fellow VPS customers would be much appreciated.

[Gwaihir]

I would not recommend such a "find all needles in this haystack" approach if you know you've been seriously hacked. If at all doable, I would backup all relevant data and ask support to reinstall your VPS from scratch. Then, if you are able to move back in only your own data, the material you are familiar with and can verify that it has nothing amiss in it, you know you are clean. If you continue to wash, as you call it, you might allways keep wondering if you really got them out completely.

[mattsiegman]

With plesk on Linux, the two users who come with the account are admin and root. On windows, I don't know what they are. I would recommend just backing up all the data and recreating the user structure.

Yeah, it sucks, but being hacked sucks in general.