Re: Signs of Apache Web Server been hacked

[Chuck Lidderdale <chucka@xxxxxxxxxxxxxxxxxx>]

Normally I just lurk hoping to pick up a thing or two but today I'd like to comment.  Way back when I ran across a script called "COPS" that runs daily.  It was/is a collection of scripts, one of which is:

find / | sum > thisrun
diff thisrun lastrun | report
mv thisrun lastrun

run = daily, weekly, hourly... your pick.  If any files get changed you're told.
Also my htaccess contains a lot of "deny from a.b.c.d" (and several n.0.0.0/8).

Chuck

You could start by seeing if any of the files have been changed
recently (OS-specific; are you running Linux?) or something has been
uploaded (if it is still there).