I found a backdoor binary file in /tmp directory. The name of that file is "fds". How can I find out who put it there?

Since this file is in /tmp directory, it was most likely put there by a vulnerable Php script. Look into the access log file(s) in /usr/local/apache/domlogs directory for the file "fds" and see if you can find the site that was used to upload the file to your server. Use the following command at the prompt:

grep -i bds /usr/local/apache/domlogs/* 

OR

grep -i bds PATH_TO_APACHE_domlogs/*

Other articles in this Category

crontab stopped working for end-users

Control Panels :: FREE and Commercial

HowTo remove saved Credit Card info from the database

Error in file: mysql4-install-0.8.0.php