./ alpha

[Shi]

Hi.
I was checking the CPU/MySQL/Apache history in WHM and at the very top owned by &nobody& and all in fancy red was a process with this description

./alpha 203.167.90.7 133 203.167.90.7

using up the most cpu and memory.

Any ideas on what it is?

much obliged.

 

[Shi]

Found the answer..thanks to Rebecca at Cyberpixels.com

its part of the greymatter exploit that will allow anyone to upload anything to the server through the comments page of someones blog.

if you have greymatter running on your servers I recommend checking to see if its patched or not.