Hack attack? passwd changed admin pass but login to panel failed!

[m2000]

Hi
this is my friend problem:

0) directadmin buy and install a few days ago.

1) Today my friend tried to login admin level directadmin.
But password failed.

2) He from ssh/root used (passwd admin) for new password

3) he can not login with new pass!

4) login page from new style has been changed to old style without password recovery link!!!

5) yesterday he in (admin level > customebuild 2 plugin > did build all).

please help.
Thanks

new style changed to this!!!

 

[m2000]

server has cloudlinux , csf , clamav

 

[m2000]

/usr/local/directadmin/conf/directadmin.conf
only contain this text:

cloud_cache=1
nginx_proxy=1
nginx=0
litespeed=0
openlitespeed=0

 

[smtalk]

This is the main problem why you cannot login and it defaults to the main skin Someone emptied /usr/local/directadmin/conf/directadmin.conf file. Please check "history" to see how it has happened.