wkd

Member
Jun 13, 2007
16
0
51
Hi all,


Can anr one help me in this problem when i browse IP like this getting hacking page and i need to change this page or remove can any one help me

http://209.216.61.165/

Thanks
 

tweakservers

Well-Known Member
Mar 30, 2006
379
0
166
your index.html page looks to have been exploited. Login via FTP or as root user to check your index.html page.
 

Todd Mitchell

Well-Known Member
Staff member
Nov 13, 2006
301
1
243
Houston, TX
It looks like the box has been rooted. The page is most likely in /usr/local/apache/htdocs/

If the server has been rooted, i recommend running rkhunter or chkrootkit to make sure no binaries were modified, and check for any other modifications or scripts listening on strange ports.
 

colet

Member
Apr 26, 2006
22
0
151
Try looking here:
/home/your_user_name/public_html

If that doesn't help then this might give you some hints:
grep DocumentRoot /usr/local/apache/conf/httpd.conf
 

wkd

Member
Jun 13, 2007
16
0
51
Thank you for helping me...
but ther is any chance to back this default page for Cpanel???
 

bsasninja

Well-Known Member
Sep 2, 2004
527
0
166
I recommend you leave a blank page instead of the cpanel one. Just to not give advice that is a cpanel server.