Recover TCAdmin installation after being hacked

[benitoll1993]

Good night.

 

I have one TCAv2 Master license (Linux), and one TCAv2 remote (Windows Server 2008 R2) Remote license. Two VPS'es in two dedicated servers (I have more VPS'es for other things, that's why I use virtualization for gameservers, but this is not the matter).

 

My Windows Server Remote Desktop was hacked by a (I think) random guy with dictionary methods (I found two dictionary .txt files with almost a million passes each in the trash can, after changing his password and entering the account he "stealthly" created). After having changed and enforced our passwords, he entered again (I'm sure he installed a trojan first time he gained control), and deactivated our 2 administrator accounts, and created one for him.

 

I could recover the control because (of course) of the vKVM of Proxmox, temporarily disabling network and a trick with restoring tool of the Windows installation .iso.

 

I have backuped TCAdmin and TCAFiles, but I don't know if I can restore them in a new Windows installation and run it without troubles. What do I need to do? I haven't still formatted the old installation, but I can't also try without doing so, as the dedicated server has not enough disk space for twice such an amount of data (not so much data, but SSD drives :S).

 

 

I'll also send this as a support ticket with high priority, sorry for the inconveniences and thank you very much in advance!

[Raizio]

Install TCAdmin fresh, then copy over TCAFiles and then restore your MySQL db.

Be sure to edit the config file in TCAdmin folder to point to the right MySQL db and such.

Then start it up and it should work. (This is for Master.)

 

For remote, put the TCAFiles. Then in TCAdmin webpanel of master, go to servers and get the remote server's config. Install TCAdmin on the remote, replace the config file with the one you downloaded and it should be good to go