Linux.com: Tips for When Hackers Strike

“Last week I was faced with the situation every user and
administrator dreads–my Web server was hacked. Here’s hoping you
can use my experience as a guide to investigating your own
compromised server, if and when the time comes.

“The nightmare started when I returned to my office to discover
17 missed calls on my cell phone. A moment later, the phone rang
again. A frantic customer complained of ‘eyes’ on his Web site. I
visit the site, and, lo and behold, discovered it proclaiming being
‘owned’ by a hacking group. Upon further investigation, I
discovered all the other Web sites on the Debian-based server had
been defaced…”

Complete
Story