Ataque desde mi servidor (Ayuda)

Buenas a todos, dispongo de varios servidores dedicados con los problemas típicos del envió de spam ocasionalmente pero este problema no me había encontrado nunca, mi proveedor del servidor me envía este mail:
Dear Sir or Madam,

NetBIOS defines a software interface and a naming convention. NetBIOS over TCP/IP provides the NetBIOS programming interface over the TCP/IP protocol.

Over the past months, systems responding to NetBIOS nameservice requests from anywhere on the Internet have been increasingly abused for DDoS reflection attacks against third parties.

Please find below a list of affected systems hosted on your network. The timestamp (timezone UTC) indicates when the openly accessible NetBIOS nameservice was identified.

We would like to ask you to check this issue and take appropriate steps to secure the NetBIOS nameservices services on the affected systems or notify your customers accordingly.

If you have recently solved the issue but received this notification again, please note the timestamp included below. You should not receive any further notifications with timestamps after the issue has been solved.

Additional information on this notification, advice on how to fix reported issues and answers to frequently asked questions: <https://reports.cert-bund.de/en/>

This message is digitally signed using PGP. Information on the signature key is available at the aforementioned URL.

Please note: This is an automatically generated message. Replying to the sender address is not possible. In case of questions, please contact <[email protected]> keeping the ticket number of this message in the subject line.

!! Please make sure to consult our HOWTOs and FAQ available at !! <https://reports.cert-bund.de/en/> first.

======================================================================
Betroffenes System in Ihrem Netzbereich: Affected system on your network:
Format: ASN | IP address | Timestamp (UTC) | Workgroup name | Machine name 8972 | 62.138.3.198 | 2017-01-18 02:49:06 | WORKGROUP | ASTRA4440 Mit freundlichen Grüßen / Kind regards Team CERT-Bund Bundesamt für Sicherheit in der Informationstechnik (BSI) Federal Office for Information Security Referat CK22 - CERT-Bund Godesberger Allee 185-189, D-53175 Bonn, Germany

Alguien me puede ayudar para saber que hacer.

Es un servidor dedicado con ‪Ubuntu 14.04.4 LTS‬ y Plesk 12.5.30

 

Posiblemente tengas algún sitio hackeado, la solución sencilla sería revisar por que puerto esta saliendo tráfico a esas IPs y cerrar los puertos o cerrar todos los puertos y dejar lo esencial solamente, luego ya ver quien y por donde manda traffico que sería lo más complicado pero no imposible un rato revisando logs debería solucionar el problema

 

Instala CSF y limita a pocas conexiones por usuario. Además, de bloquear los puertos que no necesitas. Si utilizas OVH utiliza su Firewall y pide una configuración eficaz al soporte. También te recomiendo utilizar cloudflare.