I have an attack on one of my Cpanel accounts, apparently it is a file: fbe99.php and it is damaging all the index.php

The "fbe99.php" file is definitely not a standard file within a cPanel installation and could have been uploaded to your instance following a system compromise. It would be best to search for the file and remove it immediately, then scan all other files for any additional suspicious modifications. You can boot your compute instance into Rescue Mode and run a ClamAV system file scan, which will automatically quarantine any flagged files.

While the above steps will certainly help clean up your system, it's important to take additional measures to prevent future attacks from occurring. I highly recommend updating any scripts or applications you have installed to their latest versions and changing your passwords as soon as possible. By taking these proactive steps, you can help safeguard your cPanel installation and ensure the ongoing security of your accounts.

--Eric

If you still have the fbe99. php file why not print some or all of it here… or post it somewhere that we can see it.

https://www.geeksforgeeks.org/top-7-code-sharing-website-for-developers/