Thread: CPU usage
View Single Post
Old 5th July 2012, 10:28
till till is offline
Super Moderator
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 36,986
Thanks: 840
Thanked 5,647 Times in 4,457 Posts

Try to find the program file with the find command, I guess it must be somwhere in /var/www or /tmp (not in /usr or other system directories). This is most likely a hcked or trojan script that uses the name of a common Linux application (klogd) to hide itself. But the real klogd would never run as www-data, so this fake program must be somewhere in one of your sites or in the tmp folder.
Till Brehm
Get ISPConfig support and the ISPConfig 3 manual from
Reply With Quote