I'm running Apache on Linux server. I have noticed the following processes running which I am not expecting to see, and appear rogue.
Can anyone please advise me what they mean?
Running ps aux | grep apache
gave me the following:
root 6196 0.2 0.0 86708 3100 ? Ss 04:44 0:00 sshd: apache [priv]
sshd 6202 0.0 0.0 61868 1372 ? S 04:44 0:00 sshd: apache [net]
The server was recently hacked by c99shell (http://www.chr00t.com/2009/01/c99shell-security/) script which I tracked down and removed (as far as I know).