In article <[🔎] 42E4103E.8060703@soncek.biz> you wrote: > I still haven't managed to find out how exactly this happened. And > probably reinstall will be needed? What do you think? Yes, reinstall on compromised hosts is always needed, however you should make a image of the system for forensic, you dont want to have that happen again. Maybe try to run some rootkit detectors. Is there a web server with PHP running on the system? any other server? Gruss Bernd