If we notice a DoS attack from your VPS or dedicated machine, it is very likely that it has been compromised, and we'll post you a link to this article.
The most commonly exploited vector for compromising a machine is webhosting. If you are running a website from your service here, it is very possible that one of the applications that you are running had a security hole that an attacker (manually or in an automated fashion) exploited to load their own backdoor software. Take a look at your various public-accessible folders and see if you can find a file that is out of place there -- a seemingly-benign PHP file, such as "s.php" file, for instance, or something in a new folder that you didn't create. If you find this evidence, and you were running the webserver as an unprivileged user (not as Administrator or root), then you may be able to simply:
- Disable your webhosting bits
- Reinstall the webserver from scratch
- Install all of your web-based applications, using the very latest versions, and choosing different passwords
- Notify any users of your sites that your databases may have been compromised, and let them know that any information that they had stored may now be known to the attacker
- Make sure that all of the available OS updates are applied
- Check your server for malware using an anti-virus tool
If you don't find such a file (or don't run a webserver), and you don't see other obvious signs of a break-in, you'll have to assume the worst: That the machine has been entirely compromised. This could have been done through an exploit in the OS, by guessing your password, or by malware loaded onto the machine of an administrator, for instance. In this case, you should do a similar set of steps, but for the entire OS:
- On your personal machine, and the machines of any other admins,
a. Update the OS
b. Check for malware, and potentially reinstall the OS if there is an infection
c. Change all passwords - Back up any irreplaceable documents or settings on the VPS/dedicated machine
- Completely wipe and reinstall the OS, and make sure that it is running the latest updates
- Reinstall your applications, using only the very latest versions, and choosing different passwords
- Notify users of any services on your machine that it may have been compromised, and let them know that any information that they had stored may now be known to the attacker
