mail./main ip and other index files

[oulzac]

How would one go about replacing these / fixing these.

I had one of my servers hacked, with this index replace thing. we cought them before any major damage was done, no root kits installed, no backups removed, just the index files replaced. I have restored all accounts, and ran upcp to replace the main cpanel index.
but if you go to any account with mail.domain.com it shows the hackers page. if you go to the main ip it still shows the hackers page. where are these index files and why is upcp --force not replacing them?

[oulzac]

DUH!
Nevermind, these files are not cpanel, there apache, so if anyone else does this clean up without an OS restore, dont forget to recompile apache.