Server compromise

[J Cole]

Hello, am have a problem with the server.
I got a tech to resolve an issue I had with SSL, When the server reboot it cuold not
find modules/php_ioncube_loader_lin_5.1.so
He saiw,
However permissions for /usr/lib/php/modules/php_ioncube_loader_lin_5.1.so is corect

and the, SELinux in mode Enforcing. he changed the mode to
Permissive and restarted Apache:

[root@www ~]# getenforce
Enforcing
[root@www ~]# setenforce 0
[root@www ~]# getenforce

Since then the server was compromise. Some one find a way to used 460GB of bandwidth in 24 hours.

I cannot find which domain using the bandwidth or no info in the log. All domain shows normal,
I do my own IT with little knowledge. I cannot find any log entry.

Any idea how go solve this issue.

Thanks Ja

Ca

 

[atomicturtle]

Ive got a real basic compromise procedure started here:

http://www.atomicorp.com/wiki/index.php/Compromised_System