cpanel hacked, disk usage 51mb with only wp

[amolpatil2k]

I have only wordpress installed and disk usage is 51MB. The last login is from IP 41.27.46.120, where as I login using 123.252.x.x
Edit:
I used disk usage feature to find that 20MB full backup file. How did it get there. 6MB in Ruby/Gems. I never use Ruby. And 20MB in CPanel.Form.File.Upload.blah.blah

 

[Corey]

That IP is from South Africa.

Did you change your cPanel password already?

Someone would have had to create a full backup via cPanel for it to get there, it is not done automatically.

It's possible Ruby is there by default even if you didn't use it.

The cPanel form file is a temporary file created when you upload something via cPanel's file manager. You can delete that.

-Corey

 

[amolpatil2k]

Thanks Corey. I'll change the cPanel password right away. I hope it didn't compromise anything else in your setup. Gosh, this is serious.

 

[Corey]

Every account is individually secured so it won't affect the overall server. Just be sure to use a strong password

-Corey