problem guest OS in proxmox

[sicute]

Dear all

i have promox and this have problem.
i'm installed ubuntu and debian guest os in proxmox.

and i found some file interest in guest os which after update online from fresh install.

in debian

1.i found file in /etc/rc3.d/S01afmievedhz
2.here the file
#root@bandrex:~# cat /etc/rc3.d/S01afmievedhz
#!/bin/sh
# chkconfig: 12345 90 90
# description: afmievedhz
### BEGIN INIT INFO
# Provides: afmievedhz
# Required-Start:
# Required-Stop:
# Default-Start : 1 2 3 4 5
# Default-Stop :
# Short-Decription: afmievedhz
### END INIT INFO
case $1 in
start)
/boot/afmievedhz
;;
stop)
;;
*)
/boot/afmievedhz
;;
esac
root@bandrex:~#


before that i try install ubuntu and found file in /boot

#/boot/pubyjjuoif
#/boot/tnsbyrnqjr
#/etc/rc3.d/S90awrmmrnnao -->/etc/init.d/awwrmmrnnao
#/etc/rc3.d/S90pubyjjuoif-->/etc/init.d/pubyjjuoif
#cat /etc/init.d/awwrmmrnnao
#!/bin/sh
# chkconfig: 12345 90 90
# description: awwrmmrnnao
### BEGIN INIT INFO
# Provides: awwrmmrnnao
# Required-Start:
# Required-Stop:
# Default-Start : 1 2 3 4 5
# Default-Stop :
# Short-Decription: awwrmmrnnao
### END INIT INFO
case $1 in
start)
/boot/awwrmmrnnao
;;
stop)
;;
*)
/boot/awwrmmrnnao
;;
esac

the size file all same as 648K

now every i ls -la found some file random /boot

it's is possible my proxmox have been hijack .

thanks for advice

 

[e100]

What you describe looks like you have been hacked.
Someone else has very similar issue recently: https://www.mail-archive.com/tor-relays@lists.torproject.org/msg04764.html

When you installed your guest OS did you include any services like apache, ssh, etc?
Are you using KVM or OpenVZ?

 

[sicute]

What you describe looks like you have been hacked.
Someone else has very similar issue recently: https://www.mail-archive.com/tor-relays@lists.torproject.org/msg04764.html

When you installed your guest OS did you include any services like apache, ssh, etc?
Are you using KVM or OpenVZ?

i try using both KVM and OpenVZ still same get hacked (ubuntu openvz and debian 7.7 KVM) , i have other guest os in same machine until now still working .

i suspect my proxmox machine get hacked until now i move some guest os to vmware machine to make sure my proxmox machine is hacked or not.

thanks for advice i hope get more information from other user have been same problem like me