This question already has an answer here:
- How do I deal with a compromised server? 13 answers
I am dealing with a troubling LAMP server which runs Apache 2.2, MySQL 5.1 and PHP 5.2.7 (runs as nobody) and most of its sites using vulnerable versions of known scripts such as Joomla, Wordpress etc.
It's a quite silly approach - which is not in my hands - but since the sites heavily customized in the core, updating their scripts to recent versions is not a solution for the customer but I can't keep this search and destroy mission forever. So, I am hoping to find a way to track newly created files and the source of it like abc.php created by xyz.php
I am sure that the first one is possible but not sure for the second one.
It'd be great if you can share your ideas on this matter.
P.S. : Since there are hundreds of sites, it's quite hard to change the configuration. Although it's the right solution, sadly it's not the solution that I am looking for.