Either you have a user named '1014' or the entry in /etc/passwd for the user with uid 1014 has been deleted. By all means check in /etc/passwd - but I suspect the latter scenario is more likely.
Any server process listening on a reserved port must be started by root - it then downgrades to a different user. If you run 'ps -ef' then you'll be able to get the parent process for the stuff you're concerned about. If it was started by root, then you can start to get more worried. From the
/proc/<pid>/ files you'll be able to see all sorts of stuff - like exactly where './bin/httpd' is.
The -X option for apache (if this is Apache) runs a single worker and the process does not daemonize (stays associated with the pty where it was started from). If
/proc/<pid>/exe does not point to a file supplied with your isntallation, then you may be able to find out more about it by running 'strings' against the executable.
If it is malicious, and someone is covering their tracks by deleting a passwd entry, then they may have deleted the file/directory containing the webserver (but the actual contents of the file / directory remain on the disk, hidden, while they are still in use (see
You should also be able to see what port it's listening on from netstat -na
(hence you could try pointing a browser at it).
If you have reason to suspect it is malicious, then see My server's been hacked EMERGENCY