The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

find an httpd explode

Discussion in 'General Discussion' started by mahdionline, Dec 25, 2004.

  1. mahdionline

    mahdionline Well-Known Member

    Joined:
    Oct 18, 2003
    Messages:
    127
    Likes Received:
    0
    Trophy Points:
    16
    Hi

    I find out a explode happen on our server, a user usr /usr/bin/perl to run a task , and this task make our cpu very busy.

    how can I findout which file (of which user) make this problem ?

    or

    when I have the PID of a task , how can trace it ?

    Regard
     
  2. haze

    haze Well-Known Member

    Joined:
    Dec 21, 2001
    Messages:
    1,550
    Likes Received:
    3
    Trophy Points:
    38
    It sounds to me like the phpBB worm making the rounds. Have a search on this forum for phpBB and maybe phpbb worm you should find some info from those threads on how to trace and remove and lock down the account.

    A quick way to see what it is and where it was executed etc is to go to /proc/PIDID and cat the files in that directory.

    Also check your tmp directories for suspicious files.
     
Loading...

Share This Page