unSpawn please stop trying to flame me in posts. I am trying to steer the OP in the correct direction of taking the correct first steps, which is very simple. Compare the timestamps of your email headers to your Apache log files to see if someone is compromising the site via that method, which is very very common, if thats not the case then you move forward and take the next step.

I have never tried to insult anyone in these forums or steer anyone in the wrong direction and yet you have subtly insulted me several times in different threads.

My concern is with not personal but with Incident Response being performed as we would like to see it done in the Linux Security forum. If you, instead of picturing me as an agitator, try to find out what the essence is of what I wrote about you might agree. To get an idea of what I mean please check a few (perceived) compromise threads done the past few years. And please feel free to ask any IR-related procedural questions here.


//As this could make for an interesting and educational thread I've chosen to split it off to its own thread.