duranduran

Well-Known Member
Apr 30, 2004
198
0
166
Hi, this server was down for many times in last week. Verifying the "CPU/Memory/MySQL Usage" i found this strange "user" [email protected] (153352 from cpu usage ???):

[email protected] 153352.71 0.01 0.0

No process are related. See the normal entries:

nobody 17.38 41.27 0.0
Top Process %CPU 1362 /usr/local/apache/bin/httpd -k start -DSSL
Top Process %CPU 15.7 /usr/local/apache/bin/httpd -k start -DSSL
Top Process %CPU 7.3 /usr/local/apache/bin/httpd -k start -DSSL

I execute the rkhunter and rootkit, nothing was found. This user dont exist under /etc/passwd.