Thread: CPU usage
View Single Post
Old 5th July 2012, 09:28
till till is online now
Super Moderator
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 36,046
Thanks: 826
Thanked 5,384 Times in 4,231 Posts

Try to find the program file with the find command, I guess it must be somwhere in /var/www or /tmp (not in /usr or other system directories). This is most likely a hcked or trojan script that uses the name of a common Linux application (klogd) to hide itself. But the real klogd would never run as www-data, so this fake program must be somewhere in one of your sites or in the tmp folder.
Till Brehm
Get ISPConfig support and the ISPConfig 3 manual from
Reply With Quote