[cobalt-users] [RAQ4i] Hacked or not ?

["Crocket" <crocket@xxxxxxxxxxx>]

Hi,

One of our customers who has a virtual site on one of our raq4i's, reported
problems with his site.
When I checked the site I saw the following :

- some image folders had been emptied
- folder/subfolder/*.php files have disappeared
- and those subfolder names have all been altered to the same date : Jun 12
19:46

The customer does not have ftp access to the root web. The webmaster hasn't
touched the site for at least 8 weeks. So my questions are :
- What could have caused this ?
- If the site has been hacked why leave tons of other files and others not ?
- How come the dates of the folders all point to the same date.
- What kind of logs should I check if there is anything to check ?

Thanks for any help.

Crocket