Hacked with html on every php page

[kevin197]

hi, my server has been hacked and I think I have removed everything now apart from I get some html code at the top of every index.php page on the server.

index.html and anyname.php files are fine so it's just index.php files in any directory on any site on the server.

I'm thinking this might be done in the php.ini file but I had a quick look and couldn't see anything.

I am using whm/cpanel with full root access. Can anybody tell me how they would go about showing code on every index.php page so I know where to look?

Thanks

 

[jpadie]

check the php.ini file that is called by the webserver for the value of auto_prepend_file

and do share how you were hacked and the attack vector and 'payload'. it will help us all watch out for similar issues.