jfall

Member
May 8, 2004
9
0
151
Unfortunately one of our servers was rooted today. The hacker deleted every single index.html, index.asp, index.htm and index.php file on the server and replace it with a hack message. Unfortunately they didn't rename the files, they deleted them.

Im looking into ways that I can recover from this hack. Most user accounts are backed up, I should be able to write a script to extract the index files from there and replace the bad index files. What about other index files on the server though? cPanel itself uses a lot of html files which have also been deleted, how could I go about recovering those files?
 

DigitalN

Well-Known Member
Sep 23, 2004
419
1
168
I assume that you will be restoring the OS, either way, reinstalling cPanel will resolve the missig cPanel files. You should just find the point of entry if possible, then restore and reinstall cPanel, then restore the account data.

If you aren't going to restore, then /scripts/upcp --force should replace the cPanel files.
 

dr2web

Active Member
Jan 14, 2005
33
0
156
Once you get it all restored, you might want to take a look at some of the articles at http://www.webhostgear.com. THere are a lot of articles there on firewalls, and such and there is a section on cpanel..

Quite useful.

.:: mIKE