Output from ps:

USER
PID %CPU %MEM
VSZ RSS TTY
STAT START TIME COMMAND
root
1 0.0 0.0 19236 1168 ?
Ss Dec10 12:16 init
root
2 0.0 0.0
0
0 ?
S
Dec10 0:00 [kthreadd/1391
1]
root
3 0.0 0.0
0
0 ?
S
Dec10 0:00 \_ [khelper/1
3911]
root
324 0.0 0.0 10672 472 ?
S<s Dec10 0:00 /sbin/udevd -d
dbus
1005 0.0 0.0 21540 452 ?
Ss Dec10 0:00 dbus-daemon -system
root
1016 0.0 0.0 84564 1844 ?
Ss Dec10 0:00 NetworkManager
--pid-file=/var/run/NetworkManager/NetworkManager.pid
root
1021 0.0 0.0 58036 912 ?
S
Dec10 0:00 /usr/sbin/mode
m-manager
root
1030 0.0 0.0 44980 332 ?
Ss Dec10 0:00 /usr/sbin/wpa_
supplicant -c /etc/wpa_supplicant/wpa_supplicant.conf -B -u -f /var/log/wpa_supp
licant.log -P /var/run/wpa_supplicant.pid
root
1152 0.0 0.0 66692 408 ?
Ss Dec10 0:00 /usr/sbin/sshd
root
1163 0.0 0.0 108304 1224 ?
S
Dec10 0:00 /bin/sh /usr/b
in/mysqld_safe --datadir=/var/lib/mysql --pid-file=/var/lib/mysql/cloud.xlenthos
ting.org.pid
mysql
1536 4.6 4.7 6965140 494764 ?
Sl Dec10 762:54 \_ /usr/sbin/
mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib64/mysql/plu
gin --user=mysql --log-error=/var/lib/mysql/cloud.xlenthosting.org.err --open-fi
les-limit=50000 --pid-file=/var/lib/mysql/cloud.xlenthosting.org.pid --socket=/v
ar/lib/mysql/mysql.sock
postgres 1614 0.0 0.0 209020 4004 ?
SN Dec10 0:11 /usr/bin/postm
aster -p 5432 -D /var/lib/pgsql/data
postgres 1627 0.0 0.0 179376 504 ?
SNs Dec10 0:55 \_ postgres:
logger process
postgres 1629 0.0 0.0 208112 1064 ?
SNs Dec10 4:12 \_ postgres:
writer process
postgres 1630 0.0 0.0 208112 732 ?
SNs Dec10 3:56 \_ postgres:
wal writer process
postgres 1631 0.0 0.0 209156 956 ?
SNs Dec10 0:59 \_ postgres:
autovacuum launcher process
postgres 1632 0.0 0.0 180560 712 ?
SNs Dec10 0:37 \_ postgres:
stats collector process
root
1643 0.1 0.3 802212 34308 ?
Ssl Dec10 18:28 /usr/local/cpa
nel/3rdparty/bin/clamd
mailnull 1651 0.0 0.0 70156 2816 ?
Ss Dec10 1:44 /usr/sbin/exim
-bd -q60m
root
1682 0.0 0.0 167660 4392 ?
Ss Dec10 2:59 /usr/local/cpa
nel/3rdparty/perl/514/bin/spamd -d --allowed-ips=127.0.0.1 --max-conn-per-child=
10 --pidfile=/var/run/spamd.pid --max-children=3 --max-spare=1
root
14180 0.0 0.0 176272 3492 ?
S
Dec20 0:06 \_ spamd chil
d
newrelic 1714 0.0 0.0 26100 328 ?
SNs Dec10 0:00 /usr/sbin/nrsy
smond -c /etc/newrelic/nrsysmond.cfg -p /var/run/newrelic/nrsysmond.pid
newrelic 4650 0.4 0.0 106672 3812 ?
SNl 13:28 0:21 \_ /usr/sbin/
nrsysmond -c /etc/newrelic/nrsysmond.cfg -p /var/run/newrelic/nrsysmond.pid
root
1739 0.0 0.0 19876 996 ?
Ss Dec10 1:52 /usr/sbin/dove
cot
dovecot 1752 0.0 0.0 13316 1108 ?
S
Dec10 0:22 \_ dovecot/an
vil
root
1753 0.0 0.0 13568 1288 ?
S
Dec10 0:19 \_ dovecot/lo
g
root
1756 0.0 0.0 16564 2044 ?
S
Dec10 0:49 \_ dovecot/co
nfig
dovecot 1758 0.0 0.0 29844 1740 ?
S
Dec10 1:16 \_ dovecot/au

th
dovenull
ap-login
dovenull
ap-login
spirits
ap
dovenull
ap-login
9687
ap
spirits
ap
dovenull
ap-login
dovenull
ap-login
9687
ap
9687
ap
dovenull
ap-login
dovenull
p3-login
dovenull
ap-login
dovenull
p3-login
root
VER)

14193 0.0 0.0 42392 2932 ?

13:03

0:00 \_ dovecot/im

14210 0.0 0.0 42392 2932 ?

13:03

0:00 \_ dovecot/im

14239 0.0 0.0 23292 2212 ?

13:03

0:00 \_ dovecot/im

14265 0.0 0.0 42392 2932 ?

13:03

0:00 \_ dovecot/im

14363 0.0 0.0 23280 2176 ?

13:03

0:00 \_ dovecot/im

14374 0.0 0.0 23300 2528 ?

13:03

0:00 \_ dovecot/im

14529 0.0 0.0 42392 2932 ?

13:03

0:00 \_ dovecot/im

14637 0.0 0.0 42392 2932 ?

13:03

0:00 \_ dovecot/im

14692 0.0 0.0 23304 2380 ?

13:03

0:00 \_ dovecot/im

14836 0.0 0.0 23288 2144 ?

13:03

0:00 \_ dovecot/im

2737 0.0 0.0 42244 3212 ?

14:37

0:00 \_ dovecot/im

6721 0.0 0.0 42240 3212 ?

14:39

0:00 \_ dovecot/po

10828 0.0 0.0 42244 3212 ?

14:47

0:00 \_ dovecot/im

23551 0.0 0.0 42240 3212 ?

14:50

0:00 \_ dovecot/po

1776 0.0 0.0 139116 1432 ?

Ss

Dec10

0:07 pure-ftpd (SER

root
1778 0.0 0.0 136612 1624 ?
S
Dec10 0:12 /usr/sbin/pure
-authd -s /var/run/ftpd.sock -r /usr/local/cpanel/bin/pureauth
root
1788 0.2 0.0 117508 948 ?
Ss Dec10 34:08 crond
root
17406 0.0 0.0 138440 1208 ?
SN 04:02 0:00 \_ CROND
root
17427 0.0 0.0 106068 1124 ?
SNs 04:02 0:00 | \_ /bin/b
ash -c [ ! -f /etc/cron.hourly/0anacron ] && run-parts /etc/cron.daily
root
17439 0.0 0.0 106068 1204 ?
SN 04:02 0:00 |
\_ /b
in/bash /usr/bin/run-parts /etc/cron.daily
root
1589 0.0 0.0 106068 1144 ?
SN 04:08 0:00 |
\
_ /bin/sh /etc/cron.daily/mlocate.cron
root
1617 0.8 0.7 175280 73868 ?
RN 04:08 5:13 |
|
\_ /usr/bin/updatedb -f cgroup?devpts?mqueue?nfs?nfs4?delayfs?devtmpfs?sysfs?
proc?tmpfs?binfmt_misc
root
1590 0.0 0.0 105952 608 ?
SN 04:08 0:00 |
\
_ awk -v progname=/etc/cron.daily/mlocate.cron progname {????? print progname
":\n"????? progname="";????
}????
{ print; }
root
23877 0.1 0.0 138440 1528 ?
SN 14:51 0:00 \_ CROND
root
24067 0.0 0.0 6320 920 ?
SNs 14:51 0:00
\_ jailsh
ell (softwini) [24283] ll -c php -q /home/softwini/public_html/moodle/admin/cli/
cron.php
softwini 24283 0.6 0.1 347456 14256 ?
RN 14:51 0:00
\_ ph
p -q /home/softwini/public_html/moodle/admin/cli/cron.php
root
1801 0.0 0.0 21580 376 ?
Ss Dec10 0:00 /usr/sbin/atd
root
2104 0.0 0.0 21196 1392 ?
S
Dec10 0:24 cpdavd - dorma
nt mode - accepting connec --listen=3,4
root
2108 0.0 0.0 114308 9996 ?
S
Dec10 3:10 cpsrvd (SSL) -

waiting for c --llu=1418161927 --listen=3,4,5,6,7,8,9,10 --accepted=11

root
2122 0.0 0.0 38984 2992 ?
S
Dec10 0:41 queueprocd - w
ait to process a task
root
2220 0.1 0.0 86020 9908 ?
S
Dec10 18:55 tailwatchd
root
2283 0.0 0.0 31032 1320 ?
SN Dec10 0:01 cpanellogd - s
leeping for logs
root
6564 0.1 0.7 166160 83488 ?
Ss Dec12 23:25 /usr/local/apa
che/bin/httpd -k start -DSSL
nobody 30871 0.0 0.0 156776 2484 ?
S
Dec12 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
jobseeke 31552 0.0 0.0 250884 8412 ?
S
Dec12 0:02 | \_ /usr/b
in/php /home/jobseeke/public_html/index.php
jobseeke 5108 0.0 0.0 248680 8060 ?
S
Dec12 0:00 | \_ /usr/b
in/php /home/jobseeke/public_html/index.php
nobody 31619 0.0 0.0 156620 2432 ?
S
Dec12 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
jobseeke 32115 0.0 0.0 248680 8060 ?
S
Dec12 0:00 | \_ /usr/b
in/php /home/jobseeke/public_html/index.php
jobseeke 6234 0.0 0.0 248680 8056 ?
S
Dec12 0:00 | \_ /usr/b
in/php /home/jobseeke/public_html/index.php
nobody 10186 0.0 0.0 156744 2416 ?
S
Dec12 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
ccintlbd 13439 0.0 0.0 253932 8988 ?
S
Dec12 0:19 | \_ /usr/b
in/php /home/ccintlbd/public_html/blog/index.php
nobody 18978 0.0 0.0 162364 2304 ?
S
Dec17 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
ccintlbd 19047 0.0 0.0 253884 8988 ?
S
Dec17 0:01 | \_ /usr/b
in/php /home/ccintlbd/public_html/blog/index.php
root
21562 0.0 0.1 80156 10784 ?
S
14:42 0:00 \_ /usr/local
/cpanel/3rdparty/bin/perl /usr/local/cpanel/bin/leechprotect
nobody 21566 0.2 0.7 166600 83756 ?
S
14:42 0:01 \_ /usr/local
/apache/bin/httpd -k start -DSSL
nobody 29819 0.1 0.7 166480 83392 ?
S
14:44 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
9697
25132 26.0 0.4 259672 41988 ?
R
14:51 0:00 | \_ /usr/b
in/php /home/greenwoodindiadd/public_html/index.php
nobody 29913 0.1 0.7 166640 83880 ?
S
14:44 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
nobody
3114 0.1 0.7 166564 82648 ?
S
14:46 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
biernesc 25252 8.0 0.1 249340 16808 ?
R
14:51 0:00 | \_ /usr/b
in/php /home/biernesc/public_html/xmlrpc.php
nobody
3401 0.1 0.7 166412 82472 ?
S
14:46 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
nobody 19382 0.1 0.7 166292 82236 ?
S
14:49 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
nobody 19433 0.1 0.7 166292 82244 ?
S
14:49 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
nobody 19791 0.1 0.7 166444 83244 ?
S
14:49 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
nobody 20594 0.1 0.7 166428 82276 ?
S
14:50 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
nobody 20595 0.1 0.7 166428 82372 ?
S
14:50 0:00 \_ /usr/local
/apache/bin/httpd -k start -DSSL
named
17021 0.5 1.3 1223760 144012 ?
SNsl Dec14 60:36 /usr/sbin/name
d -u named
root
23524 0.1 0.0 249288 2536 ?
Sl Dec19 5:34 /sbin/rsyslogd
-i /var/run/syslogd.pid -c 5
root
5686 11.3 0.7 239300 77980 ?
RNs 00:00 101:09 lfd - processi
ng

root
25205 1.5 0.7 239292 78252 ?
RN 14:51 0:00 \_ lfd - (chi
ld) closing
root
25235 0.0 0.7 239292 77240 ?
SN 14:51 0:00 \_ lfd - (chi
ld) checking load...
root
25251 0.5 0.0 110348 1144 ?
RN 14:51 0:00 | \_ /bin/p
s axuf
root
25246 1.0 0.7 239292 77812 ?
RN 14:51 0:00 \_ lfd - (chi
ld) process tracking...
root
1400 0.0 0.0 106664 676 ?
SN 04:08 0:01 /bin/bash /usr
/local/maldetect/maldet -b -r /home?/?/public_html 2
root
4110 0.0 0.0 106664 368 ?
SN 12:43 0:00 \_ /bin/bash
/usr/local/maldetect/maldet -b -r /home?/?/public_html 2
root
4111 0.8 0.0 54116 10024 ?
DN 12:43 1:07
\_ /usr/b
in/clamscan -d /usr/local/maldetect/sigs/rfxn.ndb -d /usr/local/maldetect/sigs/r
fxn.hdb -r --infected --no-summary -f /usr/local/maldetect/tmp/.find.1346
root
4112 0.0 0.0 100936 512 ?
SN 12:43 0:00
\_ tr -d
:
root
4113 0.0 0.0 105260 720 ?
SN 12:43 0:00
\_ sed s/
.UNOFFICIAL//
root
4114 0.0 0.0 105952 812 ?
SN 12:43 0:00
\_ awk {p
rint$2":"$1}
cintalau 24741 12.8 0.1 248028 12304 ?
R
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 24852 1.3 0.1 248028 12244 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 24890 1.4 0.1 248028 12244 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 24909 1.2 0.1 248028 12252 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 24948 1.4 0.1 248028 12244 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 24978 1.0 0.1 248028 12240 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 24992 1.7 0.1 248028 12244 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 25012 1.5 0.1 248028 12240 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 25033 1.5 0.1 248028 12244 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 25048 1.5 0.1 248028 12252 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php
cintalau 25070 1.5 0.1 248028 12248 ?
S
14:51 0:00 /usr/bin/php f /home/cintalau/public_html/cron.php