all server accounts - joomla - long loading in ACP

[barnea10]

hello
I have a problem in many joomla sites on my server.
in admin when clicking on one of the menu items -
like modules / manu and others,
the page is loading and loading untill i get 2 emails
alerting a process killed.

I have to solve it because my customers cant admin their sites
like that
please advice
its WHM Centos
thanks
barnea


messages i get are as :

lfd on server.###.info: Suspicious process running under user ###

Time:    
PID:     557918 (Parent PID:557871)
Account: ###
Uptime:  66 seconds


Executable:

/usr/bin/php


Command Line (often faked in exploits):

/usr/bin/php /home/###/public_html/administrator/index.php


Network connections by the process (if any):

tcp: xxx.xxx.xx.xx:xx -> xxx.x.xx.x:x


Files open by the process (if any):

/tmp/sess_1951d5f0dba48c2a2d6f731590867e64


Memory maps by the process (if any):

00400000-00b64000 r-xp 00000000 fd:05 295914                             /usr/bin/php
00d63000-00de9000 rw-p 00763000 fd:05 295914                             /usr/bin/php
00de9000-00e0b000 rw-p 00000000 00:00 0
01b31000-02bb2000 rw-p 00000000 00:00 0                                  [heap]
7f35faa94000-7f35faa99000 r-xp 00000000 fd:00 2359437                    /lib64/libnss_dns-2.12.so
7f35faa99000-7f35fac98000 ---p 00005000 fd:00 2359437                    /lib64/libnss_dns-2.12.so
7f35fac98000-7f35fac99000 r--p 00004000 fd:00 2359437                    /lib64/libnss_dns-2.12.so
7f35fac99000-7f35fac9a000 rw-p 00005000 fd:00 2359437                    /lib64/libnss_dns-2.12.so
7f35fac9a000-7f35fad9c000 rw-p 00000000 00:00 0
7f35fad9c000-7f35fada8000 r-xp 00000000 fd:00 2359439                    /lib64/libnss_files-2.12.so
7f35fada8000-7f35fafa8000 ---p 0000c000 fd:00 2359439                    /lib64/libnss_files-2.12.so
7f35fafa8000-7f35fafa9000 r--p 0000c000 fd:00 2359439                    /lib64/libnss_files-2.12.so
7f35fafa9000-7f35fafaa000 rw-p 0000d000 fd:00 2359439                    /lib64/libnss_files-2.12.so
7f35fafaa000-7f35fafb1000 r-xp 00000000 fd:05 281490                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_mysql.so
7f35fafb1000-7f35fb1b1000 ---p 00007000 fd:05 281490                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_mysql.so
7f35fb1b1000-7f35fb1b2000 rw-p 00007000 fd:05 281490                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_mysql.so
7f35fb1b2000-7f35fb204000 r-xp 00000000 fd:05 280747                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/sqlite.so
7f35fb204000-7f35fb403000 ---p 00052000 fd:05 280747                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/sqlite.so
7f35fb403000-7f35fb409000 rw-p 00051000 fd:05 280747                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/sqlite.so
7f35fb409000-7f35fb4a1000 r-xp 00000000 fd:05 280743                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_sqlite.so
7f35fb4a1000-7f35fb6a0000 ---p 00098000 fd:05 280743                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_sqlite.so
7f35fb6a0000-7f35fb6a4000 rw-p 00097000 fd:05 280743                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_sqlite.so
7f35fb6a4000-7f35fb6ba000 r-xp 00000000 fd:05 280744                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo.so
7f35fb6ba000-7f35fb8ba000 ---p 00016000 fd:05 280744                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo.so
7f35fb8ba000-7f35fb8bd000 rw-p 00016000 fd:05 280744                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo.so
7f35fb8bd000-7f35fb8dc000 r-xp 00000000 fd:05 281926                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/suhosin.so
7f35fb8dc000-7f35fbadb000 ---p 0001f000 fd:05 281926                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/suhosin.so
7f35fbadb000-7f35fbae1000 rw-p 0001e000 fd:05 281926                     /usr/local/lib/php/extensions/no-debug-non-zts-20090626/suhosin.so
7f35fbae1000-7f35fbae3000 rw-p 00000000 00:00 0
7f35fbae3000-7f35fbbce000 r-xp 00000000 fd:05 927525                     /usr/local/Zend/lib/Guard-5.5.0/php-5.3.x/ZendGuardLoader.so
7f35fbbce000-7f35fbcce000 ---p 000eb000 fd:05 927525                     /usr/local/Zend/lib/Guard-5.5.0/php-5.3.x/ZendGuardLoader.so
7f35fbcce000-7f35fbceb000 rw-p 000eb000 fd:05 927525                     /usr/local/Zend/lib/Guard-5.5.0/php-5.3.x/ZendGuardLoader.so
7f35fbceb000-7f35fbcef000 rw-p 00000000 00:00 0
7f35fbcef000-7f35fbdde000 r-xp 00000000 fd:05 927528                     /usr/local/IonCube/ioncube_loader_lin_5.3.so
7f35fbdde000-7f35fbedd000 ---p 000ef000 fd:05 927528                     /usr/local/IonCube/ioncube_loader_lin_5.3.so
7f35fbedd000-7f35fbeec000 rw-p 000ee000 fd:05 927528                     /usr/local/IonCube/ioncube_loader_lin_5.3.so
7f35fbeec000-7f35fbf3f000 rw-p 00000000 00:00 0
7f35fbf80000-7f35fbf89000 rw-p 00000000 00:00 0
7f35fbf89000-7f35fc0d8000 r-xp 00000000 fd:00 1704333                    /opt/xml2/lib/libxml2.so.2.9.0
7f35fc0d8000-7f35fc2d7000 ---p 0014f000 fd:00 1704333                    /opt/xml2/lib/libxml2.so.2.9.0
7f35fc2d7000-7f35fc2e1000 rw-p 0014e000 fd:00 1704333                    /opt/xml2/lib/libxml2.so.2.9.0
7f35fc2e1000-7f35fc2e3000 rw-p 00000000 00:00 0
7f35fc2e3000-7f35fc31f000 r-xp 00000000 fd:00 1704650                    /opt/xslt/lib/libxslt.so.1.1.27
7f35fc31f000-7f35fc51e000 ---p 0003c000 fd:00 1704650                    /opt/xslt/lib/libxslt.so.1.1.27
7f35fc51e000-7f35fc520000 rw-p 0003b000 fd:00 1704650                    /opt/xslt/lib/libxslt.so.1.1.27
7f35fc520000-7f35fc521000 rw-p 00000000 00:00 0
7f35fc521000-7f35fc579000 r-xp 00000000 fd:00 1704118                    /opt/curlssl/lib/libcurl.so.4.2.0
7f35fc579000-7f35fc779000 ---p 00058000 fd:00 1704118                    /opt/curlssl/lib/libcurl.so.4.2.0
7f35fc779000-7f35fc77c000 rw-p 00058000 fd:00 1704118                    /opt/curlssl/lib/libcurl.so.4.2.0
7f35fc77c000-7f35fc77e000 rw-p 00000000 00:00 0
7f35fc77e000-7f35fc7ba000 r-xp 00000000 fd:00 1703981                    /opt/pcre/lib/libpcre.so.0.0.1
7f35fc7ba000-7f35fc9b9000 ---p 0003c000 fd:00 1703981                    /opt/pcre/lib/libpcre.so.0.0.1
7f35fc9b9000-7f35fc9ba000 rw-p 0003b000 fd:00 1703981                    /opt/pcre/lib/libpcre.so.0.0.1
7f35fc9ba000-7f35fc9bd000 rw-p 00000000 00:00 0
7f35fc9bd000-7f35fc9e7000 r-xp 00000000 fd:00 1704620                    /opt/libmcrypt/lib/libmcrypt.so.4.4.8
7f35fc9e7000-7f35fcbe6000 ---p 0002a000 fd:00 1704620                    /opt/libmcrypt/lib/libmcrypt.so.4.4.8
7f35fcbe6000-7f35fcbea000 rw-p 00029000 fd:00 1704620                    /opt/libmcrypt/lib/libmcrypt.so.4.4.8
7f35fcbea000-7f35fcbf0000 rw-p 00000000 00:00 0
7f35fcbf0000-7f35fcc46000 r-xp 00000000 fd:00 1704634                    /opt/tidy/lib/libtidy-0.99.so.0.0.0
7f35fcc46000-7f35fce46000 ---p 00056000 fd:00 1704634                    /opt/tidy/lib/libtidy-0.99.so.0.0.0
7f35fce46000-7f35fce4f000 rw-p 00056000 fd:00 1704634                    /opt/tidy/lib/libtidy-0.99.so.0.0.0
7f35fce4f000-7f35fce50000 rw-p 00000000 00:00 0
7f35fce50000-7f35fce62000 r-xp 00000000 fd:00 1704683                    /opt/xslt/lib/libexslt.so.0.8.16
7f35fce62000-7f35fd062000 ---p 00012000 fd:00 1704683                    /opt/xslt/lib/libexslt.so.0.8.16
7f35fd062000-7f35fd063000 rw-p 00012000 fd:00 1704683                    /opt/xslt/lib/libexslt.so.0.8.16
7f35fd063000-7f35fd064000 rw-p 00000000 00:00 0
7f35fd072000-7f35fd073000 rw-p 00000000 00:00 0
7fff2becf000-7fff2bee4000 rwxp 00000000 00:00 0                          [stack]
7fff2bffe000-7fff2c000000 r-xp 00000000 00:00 0                          [vdso]

 

[barnea10]

Time: Wed Jun 18 15:20:39 2014 +0300
Account: ###
Resource: Process Time
Exceeded: 285 > 240 (seconds)
Executable: /usr/local/cpanel/3rdparty/perl/514/bin/perl
Command Line: cpanellogd - http logs for ###
PID: 565041 (Parent PID:564387)
Killed: Yes

 

[cPanelMichael]

Hello

What's the load on your server when this happens?

Thank you.