Panel hacked and all my site infected

[derak29]

My CWP panel hacked 3-4 months ago and i clear all hacker files. All pages indexed and url still active. when enter https://domain.com/?o=89095421 yes link going to the website home page but in google index i have 1000 indexed pages like this https://domain.com/?o=89095421  Reinstalled wordpress websites. Even i delete domain with account from server for check links with CWP default page but still url working. That mean website databases clean but something still on CWP panel. when i check the usrl https://domain.com/?o=89095421 in google inspection url still a live. I dont want resintall CWP and lot of accounts. Mybe someone have information and solution regarding my case.

[derak29]

[anandmys]

Check this thread. You may get some hint

https://forum.centos-webpanel.com/centos-webpanel-bugs/critical-multiple-cwp-servers-infected-arbitrary-php-code-execution-via-publ/?topicseen

[overseer]

We can't directly help you without more specifics. If you want us to take a look, what is the actual domain in question?
Please do read that thread anandmys linked -- completely. You can see how to disinfect the server and mitigate other PHP injection attacks. You need to secure your PHP Installation and disable any unused functions.