[CentOS] attack

Thu Dec 24 11:38:45 UTC 2009
John Doe <jdmls at yahoo.com>

From: Manu Verhaegen <maverh at telenet.be>
> My server is under attack allows the attacker to abuse of a php script of a 
> vhost. How can I find what is the script.

Could you be more specific...?
Anything in the log files?

JD