high mysql loads

[InternetPEI]

Been getting this in the processes when I hit on trace..

Is it a bad script or someone wanting in?

Thanks



pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117352) = 54
pread(65, "\3\0F\2\24e\10\0\0D\0\0\0\tcigare", 20, 117408) = 20
pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117428) = 54
pread(65, "\3\0F\2\24f\10\0\0B\0\0\0\tcigare", 20, 117484) = 20
pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117504) = 54
pread(65, "\3\0F\2\24g\10\0\0$\4\0\0\tcigare", 20, 117560) = 20
pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117580) = 54
pread(65, "\3\0F\2\24h\10\0\0%\4\0\0\tcigare", 20, 117636) = 20
pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117656) = 54
pread(65, "\3\0F\2\24i\10\0\0K\0\0\0\tcigare", 20, 117712) = 20
pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117732) = 54
pread(65, "\3\0F\2\24j\10\0\0\3\0\0\0\tcigare", 20, 117788) = 20
pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117808) = 54
pread(65, "\3\0F\2\24k\10\0\0\v\0\0\0\tcigare", 20, 117864) = 20
pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117884) = 54
pread(65, "\3\0K\1\24l\10\0\0C\3\0\0\6parten", 20, 117940) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 117960) = 59
pread(65, "\3\0K\1\24m\10\0\0F\3\0\0\6parten", 20, 118020) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118040) = 59
pread(65, "\3\0K\1\24n\10\0\0005\0\0\0\6parten", 20, 118100) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118120) = 59
pread(65, "\3\0K\1\24o\10\0\0+\0\0\0\6parten", 20, 118180) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118200) = 59
pread(65, "\3\0K\1\24p\10\0\0D\0\0\0\6parten", 20, 118260) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118280) = 59
pread(65, "\3\0K\1\24q\10\0\0B\0\0\0\6parten", 20, 118340) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118360) = 59
pread(65, "\3\0K\1\24r\10\0\0$\4\0\0\6parten", 20, 118420) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118440) = 59
pread(65, "\3\0K\1\24s\10\0\0%\4\0\0\6parten", 20, 118500) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118520) = 59
pread(65, "\3\0K\1\24t\10\0\0\3\0\0\0\6parten", 20, 118580) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118600) = 59
pread(65, "\3\0K\1\24u\10\0\0K\0\0\0\6parten", 20, 118660) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118680) = 59
pread(65, "\3\0K\1\24v\10\0\0\v\0\0\0\6parten", 20, 118740) = 20
pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118760) = 59
pread(65, "\3\0O\1\24w\10\0\0C\3\0\0\5maaal\"", 20, 118820) = 20
pread(65, "\0my name is maaal, i like you si"..., 63, 118840) = 63
pread(65, "\3\0O\1\24x\10\0\0F\3\0\0\5maaal\"", 20, 118904) = 20
pread(65, "\0my name is maaal, i like you si"..., 63, 118924) = 63
pread(65, "\3\0O\1\24y\10\0\0005\0\0\0\5maaal\"", 20, 118988) = 20
pread(65, "\0my name is maaal, i like you si"..., 63, 119008) = 63

[AndyReed]

This is a result of a bad/insecure Php script. I suggest you secure your server and now. Search these forums on howto.

[InternetPEI]

Thanks .

[jols]

I've been getting high mysql loads as well.

What do you mean when you say, "when I hit on trace..."?

How do you call up a trace like this? Something like %trace [PID} ?

[InternetPEI]

I've been getting high mysql loads as well.

What do you mean when you say, "when I hit on trace..."?

How do you call up a trace like this? Something like %trace [PID} ?

WHM-Show Current CPU Usage (under System Health)-click on the PID-Click Trace

Check your tmp.. looked like mine was due to a exploit in advanced guestbook that a client had installed.

[jols]

Thanks very much.