I already requested my hosting provider to check server log. Well, I see other file. It is ironshell.php Any more idea? Thanks. Vichea On Sun, Jul 11, 2010 at 12:58 AM, Davide Baglieri <davidonzo@xxxxxxxxx>wrote: > Not only the index file was modified, but some file has been uploaded > to the server: http://elt.edu.kh/1.gif > > I just can success you to look the server logs and find when and how > the file 1.gif has been uploaded to the server. > > On 10 July 2010 19:54, Sovichea SOU <svch_sou@xxxxxxxxxxx> wrote: > > Here it is: elt.edu.kh > > I rename hacked file to http://elt.edu.kh/index_old.htm > > > > Thanks. > > > > > > > > On Sun, Jul 11, 2010 at 12:50 AM, Davide Baglieri <davidonzo@xxxxxxxxx > >wrote: > > > >> > >> > >> Can you link us the hacked website? > >> There is any public upload form? > >> > >> Maybe someone upload a C99 shell. > >> > >> > >> > [Non-text portions of this message have been removed]
