sh r.sh -r --cpanel-conf ?? + Help, injected files!

[jeroman8]

Anyone know what this is for command:

sh r.sh -r --cpanel-conf

Listed under CPU usage.

I'm looking for the source of a hack.
2 serverns today was exploited - all users with folders 777 and files 666
was injected with a code.

Any good ideas on how to find the source - how they did it (?) ?

I thought it would take som CPU power so I checked there and both
servers has that command - no other servers.
But I did reinstall clamd, if that could be it.


Thanls!