Results 1 to 9 of 9
  1. #1
    Join Date
    Aug 2004
    Posts
    242

  2. #2
    Join Date
    Mar 2003
    Location
    Canada
    Posts
    9,072
    The screenshot you included is unfortunately not helpful at all... it doesn't provide any clues as to what's spawning all of those processes.

    If the server is even responsive, can you run the following commands:

    ps aux | grep -c http
    ps aux | grep -c exim
    ps aux >> output.txt

    The last command will record all of the processes running, while the first two will tell you how many Apache and Exim processes there are.
    RACK911 Labs | Penetration Testing | https://www.RACK911Labs.ca

    www.HostingSecList.com - Security Notices for the Hosting Community.

  3. #3
    Join Date
    Aug 2004
    Posts
    242
    Yeah, the attack is stopped now. There was a .php script with a security flaw used to send millions of spams. There were many Exim processes.

  4. #4
    Join Date
    Jun 2006
    Location
    NYC / Memphis, TN
    Posts
    1,454
    Nice.

    Recommend setting a maxproc
    PeakVPN.Com | Complete Privacy VPN | Cloud Hosting | Guaranteed Security | 1Gbps-10Gbps Unmetered
    PeakVPN | 31 VPN Servers | 17-Years Experience | Emergency 24/7 Support
    Visit us @ PeakVPN.Com (Coming SOON) | ASN: 3915

  5. #5
    Join Date
    May 2006
    Posts
    92
    well this is not fun when it is security issue with applications/web but good that you find the problem. nice work.

  6. #6
    Join Date
    Feb 2003
    Location
    Panorama City, CA
    Posts
    2,581
    i giggled at the load, hehe
    Remote Hands and Your Local Tech for the Los Angeles area.

    (310) 573-8050 - LinkedIn

  7. #7
    Join Date
    Apr 2004
    Location
    Singapore
    Posts
    1,522
    The best load I ever see
    tanfwc

  8. #8
    Join Date
    Mar 2007
    Location
    UK
    Posts
    852
    Nice load, was going to say how did you manage to get into SSH, however i can see the CPU usage was quite low. Otherwise i doubt you would of had any luck in SSH.
    ZXPlay
    Premium Virtual Private Servers | Dedicated Media Streaming Servers
    Dedicated Resources | EU Based
    www.zxplay.co.uk

  9. #9
    Join Date
    Aug 2004
    Posts
    242
    I was already SSHed. Another admin tried to get in but he couldn't. It didn't get higher in load. Then i got disconnected.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •