[TriLUG] Possibly compromised Apache binary on my webserver

[Michael Peters]

Mark Turner wrote:

> 1. Delete or rename your xmlrpc.php.
> 2. Clear your browser cache
> 3. See if Apache still sends xmlrpc.php to you. ("wget 
> http://www.somesite.com/xmlrpc.php" should suffice)

Did you restart Apache in this testing? I'd suspect something caching the php 
code before I'd suspect a compromised binary.

-- 
Michael Peters
Plus Three, LP