gam_server??

Hi, emails users of ispconfig are used to send spam days ago.

After change passwords of this users stop spam, but in top always appear this:

Code:

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                        
11952 web26_au  20   0  2564 1136  984 S    0  0.0   0:00.00 gam_server                                                                                      
11956 web26_ba  20   0  2564 1132  984 S    0  0.0   0:00.00 gam_server                                                                                      
11974 web26_ba  20   0  3412 1024  836 S    0  0.0   0:00.12 imapd                                                                                           
12065 web26_au  20   0  3412 1040  840 S    0  0.0   0:00.10 imapd           

what is gam_server?
is the server hacked?

 

From the website http://people.gnome.org/~veillard/gamin/

 

OK, and why always this users are in top output?

 

You can always see those in top, since it's a process that's running .. :/

 

minimun 2 days

 

i kill this process but this reappear

 

is it causing you problems then? You can just let it run ..

 

But only appear process for users of web26 (i have > 200 sites) and not finished never.

Why?

 

Is it maybe started by a cron job?

 

i think not.

crontab -l

Code:

30 00 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/ftp_logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/mail_logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/cleanup.php &> /dev/null
0 4 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/webalizer.php &> /dev/null
0,30 * * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/check_services.php &> /dev/null
15 3,15 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/quota_msg.php &> /dev/null
40 00 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/traffic.php &> /dev/null
05 02 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/backup.php &> /dev/null
0 4 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/awstats.php &> /dev/null

 

any more ideas?
i don't know why success this

 

Did you check the cron directories inside /etc?

 

nothing in all crons

 

Do you have monit installed? Maybe it is restarted by monit.

 

I have not installed monit

 

I'm running out of ideas...

 

But you think the server its hacked?

 

Not sure. Did you run rkhunter and chkrootkit?

 

Yes, and two pass ok