Re: [users@httpd] Signs of Apache Web Server been hacked

2013-11-10 Thread Rizwan Raza
There is a bunch of php scripts on the server. Not sure how to inspect and find out the hijacked piece. I would appreciate any suggestion(s) On Sun, Nov 10, 2013 at 6:55 PM, Nick Kew wrote: > > On 11 Nov 2013, at 00:15, Rizwan Raza wrote: > > > Notice the last two listings. What

[users@httpd] Signs of Apache Web Server been hacked

2013-11-10 Thread Rizwan Raza
When I executed the command below ps aux | grep apache I got the following output apache 16051 0.0 0.1 24676 4532 ?S15:04 0:00 /usr/sbin/httpd apache 31784 0.2 0.4 40164 13424 ?S15:52 0:02 /usr/sbin/httpd apache5412 1.5 0.4 41216 13776 ?S