[CentOS] attack

Hi,

My server is under attack allows the attacker to abuse of a php script of a vhost. How can I find what is the script.

Regards,
  maverh