Almost Every Day strange proceses taking up 90% of my cpu

February 6, 2018 260 views
Apache PHP Ubuntu
masterinho52
By:
masterinho52

Almost every day I receive an alert email telling me that CPU is higher than 70% and always it's a weird and different process that I can not find any info, please help.

Proceses names:

  • phpadYGh4_xguep. user: www-data
  • phprlAgER_xguep user: www-data
  • phpwjRDtF_xguep. user: www-data 99.7%
  • phpGZHefh_xguep user: www-data 99.8%
  • php0Lo20s_xguep user: www-data 100 %
  • php0cqpRh_xquep user: www-data 99.8%
  • phpcelNMD_3gtmn user: www-data 92.8 %
  • phpIl0BQF_3gtmn user: www-data 97.4%
  • phpRbmj1P_xguep. user: www-data 92.1 %
Log In to Comment
1 Answer
ryanpq MOD February 8, 2018
Accepted Answer

Unfortunately this most likely indicates that your droplet has been compromised and malware is running on it either to attack other servers or with the CPU use here, possibly mining cryptocurrency.

You should immediately back up any needed files and create a new clean server to migrate to. Cleaning an infected server can be an extremely time consuming and often futile process. Once you have a new server set up there are a few steps you can take to help secure it:

  • Use an SSH key for authentication rather than a password

  • Configure automatic security updates

  • Change the default SSH port

  • Enable the local firewall.

These guides will help you with these steps:

Unattended updates
Initial Server Setup (includes ssh keys, firewall, changing ssh port)

Initial Server Setup with Ubuntu 16.04
When you start a new server, there are a few steps that you should take every time to add some basic security and give you a solid foundation. In this guide, we'll walk you through the basic steps necessary to hit the ground running with Ubuntu 16.04.
Reply
  • masterinho52 February 9, 2018

    Dear @ryanpq thank you for responding.
    The server has firewall enabled (ufw) and the access is allowed only using ssh-key.

    How can I protect in a better way the new server ? (Besides changing SSH default port and automatic updates)??

    Thank you again!

Have another answer? Share your knowledge.

Related Questions