Weird stuff since S58

[nbento]

hi guys I need some help here, since Im out of ideas.
Since cpanel update for S58 some weird stuff is going on.

Apache becomes the top pross with over 55.1 on cpu running as nobody... this never happened before
Some pross like udp.pl opn some accounts become, extremly high (over 70%)

I started to recive emails:

IMPORTANT: Do not ignore this email.
This is cPanel cpuwatch on aa.xxxxxx.com!
While processing, the cpu has been
maxed out for more than a 6 hour period. The current load/uptime line on the server at the time of this email is

And:

IMPORTANT: Do not ignore this email.
This is cPanel stats runner on aa.xxxxx.com!
While processing the log files for user accountnamehere, the cpu has been maxed out for more than a 6 hour period. The current load/uptime line on the server at the time of this email is

My /home quota went from 35% up to 82% (I do wonder why)

Any ideas whats going on, or how can I fix this?

 

[mfreund]

thoought this was a support forum.....Dude cpanel support sucks...I have same issue

 

[Beansprout]

If you don't recognise the letters 'UDP' then you shouldn't be running a server.

Someone is using your server to run a perl script which, most likely is (or is trying to) send out a UDP flood.

This is nothing to do with cPanel

 

[randomuser]

@mfreund

This isn't an official cPanel support forum. This is a community based forum for cPanel users and administrators. Sometimes cPanel staff do post here for various reasons, but it is not to be relied upon for support from cPanel directly. For that, instead of saying cPanel support sucks, you should open a ticket with cPanel, or have your provider do so. Support from cPanel, when using the official support channels, does not suck, and is often extremely helpful and fast.

@nbento

Your box is hacked. Hire a sysadmin. I personally recommend Steven from rack911.com.

 

[Beansprout]

Your box is hacked. Hire a sysadmin. I personally recommend Steven from rack911.com.

No, it's not hacked, just badly setup and monitored.

 

[randomuser]

No, it's not hacked, just badly setup and monitored.

Some pross like udp.pl opn some accounts become, extremly high (over 70%)

I stand by my judgement that his server is hacked/cracked/whatever you want to label it, unless perhaps he's giving out shell access to customers.