ciao "stai_tranquillo",

ho scaricato i logs del pannello di controllo (plesk) e ho trovato questo:

17.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'UebiMiau-2.7-4' => 'UebiMiau-2.7-4')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'AutoIndex-1.5.1-2' => 'AutoIndex-1.5.1-2')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'WebCalendar-0.9.45-1' => 'WebCalendar-0.9.45-1')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'CSLH-2.9.8-1' => 'CSLH-2.9.8-1')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'WebShopmanager-2.0-2' => 'WebShopmanager-2.0-2')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'Coppermine-1.3.2-6' => 'Coppermine-1.3.2-6')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'WordPress-1.2.1-1' => 'WordPress-1.2.1-1')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'DocFAQ-1.71-4' => 'DocFAQ-1.71-4')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'b2evolution-0.9.0.11-2' => 'b2evolution-0.9.0.11-2')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'Mambo-4.5.1-6' => 'Mambo-4.5.1-6')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'bbclone-0.46a-1' => 'bbclone-0.46a-1')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'Owl-0.73-3' => 'Owl-0.73-3')
217.174.249.1 admin [2007-05-30 16:48:04] 'CP User Login' ('Contact Name': '' => 'Fabio LEONE')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'gallery-1.4.4-3' => 'gallery-1.4.4-3')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'PostNuke-0.750-2' => 'PostNuke-0.750-2')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'TUTOS-1.82-1' => 'TUTOS-1.82-1')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'Tellme-1.2-3' => 'Tellme-1.2-3')
217.174.249.1 admin [2007-05-30 16:48:04] 'Uninstall Site Application Package' ('Package name': 'AdvancedPoll-2.03-1' => 'AdvancedPoll-2.03-1')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'UebiMiau-2.7.8-2' => 'UebiMiau-2.7.8-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'phpMoney-1.3-6' => 'phpMoney-1.3-6')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'DocFAQ-1.71-5' => 'DocFAQ-1.71-5')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'phpsurveyor-0.98-6' => 'phpsurveyor-0.98-6')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'pLog-0.3.2-1' => 'pLog-0.3.2-1')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'WebCalendar-1.0-2' => 'WebCalendar-1.0-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'phpMyFamily-1.4.0-2' => 'phpMyFamily-1.4.0-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'gallery-2.0-5' => 'gallery-2.0-5')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'typo-3.7-1' => 'typo-3.7-1')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'phpAds-2.0-1' => 'phpAds-2.0-1')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'WebShopmanager-2.0-3' => 'WebShopmanager-2.0-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'phpsurveyor-0.98-7' => 'phpsurveyor-0.98-7')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'gtchat-0.93-3' => 'gtchat-0.93-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'xrms-1.18-1' => 'xrms-1.18-1')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'phpBB-2.0.11-2' => 'phpBB-2.0.11-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'WordPress-1.5.1-2' => 'WordPress-1.5.1-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'phpWiki-1.3.11-3' => 'phpWiki-1.3.11-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'Owl-0.80-3' => 'Owl-0.80-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'AdvancedPoll-2.03-2' => 'AdvancedPoll-2.03-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'phpBook-1.50-3' => 'phpBook-1.50-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'xrms-1.18-2' => 'xrms-1.18-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'pLog-1.0-3' => 'pLog-1.0-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'phpAds-2.0.4-3' => 'phpAds-2.0.4-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'AutoIndex-1.5.2-3' => 'AutoIndex-1.5.2-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'phpBugTracker-1.19-1' => 'phpBugTracker-1.19-1')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'Mambo-4.5.2-2' => 'Mambo-4.5.2-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'PostNuke-0.750-3' => 'PostNuke-0.750-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'phpBB-2.0.11-3' => 'phpBB-2.0.11-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'b2evolution-0.9.0.11-3' => 'b2evolution-0.9.0.11-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'phpDig-1.85-1' => 'phpDig-1.85-1')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'osCommerce-2.2ms2-6' => 'osCommerce-2.2ms2-6')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'Tellme-1.2-4' => 'Tellme-1.2-4')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'phpBook-1.50-4' => 'phpBook-1.50-4')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'bbclone-0.48-4' => 'bbclone-0.48-4')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'phpMoney-1.3-5' => 'phpMoney-1.3-5')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'gtchat-0.93-2' => 'gtchat-0.93-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'openbiblio-0.5-10' => 'openbiblio-0.5-10')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'TUTOS-1.88-2' => 'TUTOS-1.88-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'phpBugTracker-1.19-2' => 'phpBugTracker-1.19-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'Coppermine-1.3.2-7' => 'Coppermine-1.3.2-7')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'phpMyFamily-1.4.0-1' => 'phpMyFamily-1.4.0-1')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'openbiblio-0.5-9' => 'openbiblio-0.5-9')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'typo-3.7-2' => 'typo-3.7-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'phpDig-1.85-2' => 'phpDig-1.85-2')
217.174.249.1 admin [2007-05-30 16:48:05] 'Install Site Application Package' ('Package name': 'CSLH-2.10.5-3' => 'CSLH-2.10.5-3')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'phpWiki-1.2-8' => 'phpWiki-1.2-8')
217.174.249.1 admin [2007-05-30 16:48:05] 'Uninstall Site Application Package' ('Package name': 'osCommerce-2.2ms2-5' => 'osCommerce-2.2ms2-5')
217.174.249.1 admin [2007-05-30 16:49:11] 'CP User Logout' ('Contact Name': 'Fabio LEONE' => '')
217.174.249.1 admin [2007-05-30 19:55:51] 'CP User Login' ('Contact Name': '' => 'Fabio LEONE')
217.174.249.1 admin [2007-05-30 19:55:51] 'CP User Login' ('Contact Name': '' => 'Fabio LEONE')
217.174.249.1 admin [2007-05-30 19:56:58] 'CP User Logout' ('Contact Name': 'Fabio LEONE' => '')
217.174.249.1 admin [2007-05-30 19:56:59] 'CP User Logout' ('Contact Name': 'Fabio LEONE' => '')
217.174.249.1 admin [2007-05-30 21:58:39] 'CP User Login' ('Contact Name': '' => 'Fabio LEONE')
217.174.249.1 admin [2007-05-30 22:00:20] 'CP User Logout' ('Contact Name': 'Fabio LEONE' => '')
217.174.249.1 admin [2007-05-31 00:01:30] 'CP User Login' ('Contact Name': '' => 'Fabio LEONE')
217.174.249.1 admin [2007-05-31 00:02:37] 'CP User Logout' ('Contact Name': 'Fabio LEONE' => '')
217.174.249.1 admin [2007-05-31 00:12:30] 'CP User Login' ('Contact Name': '' => 'Fabio LEONE')
217.174.249.1 admin [2007-05-31 00:13:36] 'CP User Logout' ('Contact Name': 'Fabio LEONE' => '')

praticamente qualcuno è entrato come admin da pannello di controllo dall'indirizzo 217.174.249.1. E' un indirizzo IP inglese. Ora, come da vostro consiglio, ho cambiato le passwords e ho anche disattivato il pannello di controllo in modo tale da accedere al server solo via ssh da un unico indirizzo ip... però... potresti darmi un consiglio a riguardo?... come li trovo i rootkit? Grazie in anticipo per la risposta.

Fabio.