0

Over the weekend one of the virtual servers that I host was compromised and since then I've had all sorts of problems popping up.

The latest one is Apache taking 100% cpu usage as soon as it's started and staying like that until it is killed off.

ps aux returns:

http://pastebin.com/kzcPmq4g

strace on the process returns this, spamming very very quickly over and over again.

select(8, [3], NULL, NULL, {0, 0}) = 0 (Timeout)

access_log on the site returns:

http://pastie.org/6112068

It looks like a wordpress cron is being accessed very quickly from a remote IP.

JamieB
  • 101
  • 4

1 Answers1

2

If your system was hacked, don't try to troubleshoot this problem. You gotta do a full reinstall. Unless you are really skilled in this field, you'll never know if your system still has any root kits installed that will continue to cause problems. The only sure way is to nuke your whole system and reinstall.

Mxx
  • 2,390