Hi all,
I'm sorry that i canot provide more info for this attack as it is not my server.. but what i can say is that is it a web hosting server and we cannot just plug it off from the net.. there's a few client hosting inside.. we will try to figure out asap and then re-install everything..