hack issue :: all files deleted.
Hi there ,
Some of our websites in our server hacked ! :mad:
Hacker deleted all files in public_html folder and uploaded index.htm .
We use Cpanel .
Installed apache 2.2 + php5 + suphp
Example : ( ppncom hacked )
and all files deleted in public_html :
How can I to find how and who delete our files ?
Please advise
Some of our websites in our server hacked ! :mad:
Hacker deleted all files in public_html folder and uploaded index.htm .
We use Cpanel .
Installed apache 2.2 + php5 + suphp
Example : ( ppncom hacked )
Code:
root@constantine [/home/ppncom]# ls -l
total 88
drwx--x--x 11 ppncom ppncom 4096 Oct 13 01:10 ./
drwx--x--x 531 root root 20480 Oct 13 06:06 ../
lrwxrwxrwx 1 ppncom ppncom 32 Sep 9 12:03 access-logs -> /usr/local/apache/domlogs/ppncom/
-rw-r--r-- 1 ppncom ppncom 24 Jun 17 13:20 .bash_logout
-rw-r--r-- 1 ppncom ppncom 176 Jun 17 13:20 .bash_profile
-rw-r--r-- 1 ppncom ppncom 124 Jun 17 13:20 .bashrc
-rw------- 1 ppncom ppncom 19 Jun 17 13:20 .contactemail
drwxr-xr-x 5 ppncom ppncom 4096 Sep 12 06:33 .cpanel/
drwxr-xr-x 3 ppncom ppncom 4096 Sep 9 12:03 cpmove.psql/
drwxr-x--- 3 ppncom mail 4096 Jun 18 11:22 etc/
drwxr-x--- 2 ppncom nobody 4096 Jun 17 13:20 .htpasswds/
-rw-r--r-- 1 ppncom ppncom 7 Sep 9 12:02 .lang
-rw------- 1 ppncom ppncom 14 Oct 13 01:10 .lastlogin
drwxrwx--- 7 ppncom ppncom 4096 Sep 26 10:25 mail/
drwxr-xr-x 3 ppncom ppncom 4096 Dec 27 2007 public_ftp/
drwxr-xr-x 2 ppncom ppncom 4096 Oct 13 01:09 public_html/
drwxr-xr-x 7 ppncom ppncom 4096 Oct 13 01:09 tmp/
drwx------ 3 ppncom ppncom 4096 Oct 13 01:09 .trash/
lrwxrwxrwx 1 ppncom ppncom 11 Sep 9 12:03 www -> public_html/Code:
root@constantine [/home/ppncom/public_html]# ls -l
total 12
drwxr-xr-x 2 ppncom ppncom 4096 Oct 13 01:09 ./
drwx--x--x 11 ppncom ppncom 4096 Oct 13 01:10 ../
-rw-r--r-- 1 ppncom ppncom 0 Oct 13 01:09 .htaccess
-rw-r--r-- 1 ppncom ppncom 3890 Oct 13 01:09 index.htmPlease advise