I found strane folder on my server in /www. How can i know who put them there? in which time? Or is my services is attacked and who is intruder.
What do you mean by "strange"? Can you show the line of the folder by copying the output of ls -la? To test if there is any rootkit or sth. like this on your server, try rkhunter
