Hi there ,

Some of our websites in our server hacked ! hack issue :: all files deleted.

Hacker deleted all files in public_html folder and uploaded index.htm .

We use Cpanel .
Installed apache 2.2 + php5 + suphp

Example : ( ppncom hacked )
Code: 
root@constantine [/home/ppncom]# ls -l
total 88
drwx--x--x  11 ppncom ppncom  4096 Oct 13 01:10 ./
drwx--x--x 531 root   root   20480 Oct 13 06:06 ../
lrwxrwxrwx   1 ppncom ppncom    32 Sep  9 12:03 access-logs -> /usr/local/apache/domlogs/ppncom/
-rw-r--r--   1 ppncom ppncom    24 Jun 17 13:20 .bash_logout
-rw-r--r--   1 ppncom ppncom   176 Jun 17 13:20 .bash_profile
-rw-r--r--   1 ppncom ppncom   124 Jun 17 13:20 .bashrc
-rw-------   1 ppncom ppncom    19 Jun 17 13:20 .contactemail
drwxr-xr-x   5 ppncom ppncom  4096 Sep 12 06:33 .cpanel/
drwxr-xr-x   3 ppncom ppncom  4096 Sep  9 12:03 cpmove.psql/
drwxr-x---   3 ppncom mail    4096 Jun 18 11:22 etc/
drwxr-x---   2 ppncom nobody  4096 Jun 17 13:20 .htpasswds/
-rw-r--r--   1 ppncom ppncom     7 Sep  9 12:02 .lang
-rw-------   1 ppncom ppncom    14 Oct 13 01:10 .lastlogin
drwxrwx---   7 ppncom ppncom  4096 Sep 26 10:25 mail/
drwxr-xr-x   3 ppncom ppncom  4096 Dec 27  2007 public_ftp/
drwxr-xr-x   2 ppncom ppncom  4096 Oct 13 01:09 public_html/
drwxr-xr-x   7 ppncom ppncom  4096 Oct 13 01:09 tmp/
drwx------   3 ppncom ppncom  4096 Oct 13 01:09 .trash/
lrwxrwxrwx   1 ppncom ppncom    11 Sep  9 12:03 www -> public_html/
and all files deleted in public_html :
Code: 
root@constantine [/home/ppncom/public_html]# ls -l
total 12
drwxr-xr-x  2 ppncom ppncom 4096 Oct 13 01:09 ./
drwx--x--x 11 ppncom ppncom 4096 Oct 13 01:10 ../
-rw-r--r--  1 ppncom ppncom    0 Oct 13 01:09 .htaccess
-rw-r--r--  1 ppncom ppncom 3890 Oct 13 01:09 index.htm
How can I to find how and who delete our files ?

Please advise