YSITD_TG_Bot
says to
#ysitd
<BirkhoffLee>: 問，server 被入侵後 .php 檔案被更名為 .php.suspected