Thread: CPU usage
View Single Post
Old 5th July 2012, 09:28
till till is offline
Super Moderator
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 36,419
Thanks: 834
Thanked 5,498 Times in 4,328 Posts

Try to find the program file with the find command, I guess it must be somwhere in /var/www or /tmp (not in /usr or other system directories). This is most likely a hcked or trojan script that uses the name of a common Linux application (klogd) to hide itself. But the real klogd would never run as www-data, so this fake program must be somewhere in one of your sites or in the tmp folder.
Till Brehm
Get ISPConfig support and the ISPConfig 3 manual from
Reply With Quote