I was working on WHM of my server sudeenly i saw CPU load was increasing and till when i understand CPU load was on peak of 160%. I tried to find out CPU overloading sites and found that my 4 populer sites were creating problem. I stopped apache and suspanded all 4 sites and rebooted server. After forceful server reboot i found that load was getting normal to 2.5%. I unsuspanded one of 2 forums but even i unsuspanded that forum was not opening (IPB). I logged into ftp suspecting some problem i found that index.php was only 45bytes i have opend index.php and found this text inside
# i'm love kuwait 4 ever [ by kuwait hacker ]
I found that all file name started with index were modified and had only this text. I restored that replaced files in mins and forums started working again CPU load was normal. I found that all 4 sites 2 image hosting and 2 forums (IPB & Vbulletin) got same problem. I restored all and sudenly putty given some message
brodcasted from root server is rebooted
and it got shutted down i guess that hacker shutted down or i am not sure support department of my server is not even there to reply my support ticket. My server loose ping since that message i guesss its shutdown.
Any one can help me know what happned ??