What is this? ./anything

[persianwhois]

What is this process?
./anything

Afrer this process, our server load uo to 699 (Just in a second) and server down.

http://www.upload.sisiric.com/images/919_attack_tn.jpg

[stan01]

I'm guessing, that the wwwpars account got hacked. Considering the fact, that so many processes were spawned, I'd say it is a mailer of some sort. You can check the file's content by doing:

vi /home/wwwpars/public_html/anything

or wherever the file is located. To make sure it doesn't start anymore, you can chmod it to 0 and chown it to root.

[ddmd]

What is this process?
./anything

Afrer this process, our server load uo to 699 (Just in a second) and server down.

http://www.upload.sisiric.com/images/919_attack_tn.jpg

That really looks strange. The process was executed locally instead of giving the full path and with so many forks.

Try doing lsof -p 10526 (or whatever process it has now) to see what it is doing...