ایمیل مداوم Suspicious process running under user nobody

[ertebat7]

سلام
هر دو سه دقیقه یکبار این ایمیل برای من میاد
خواهشا راهنمایی بفرمایید این ایمیل داره چی میگه و چطور باید رفعش کنم؟

Time: Tue Sep 25 18:48:04 2012 +0330
PID: 10500
Account: nobody
Uptime: 249 seconds


Executable:

/usr/local/lsws/bin/lshttpd.4.1.13


Command Line (often faked in exploits):

litespeed (lshttpd)


Network connections by the process (if any):


tcp: 5.135.55.13:80 -> 65.49.2.178:19793
tcp: 5.135.55.13:80 -> 65.49.2.178:17276
tcp: 5.135.55.13:80 -> 65.49.2.178:57927
tcp: 5.135.55.13:80 -> 217.219.168.11:2667
tcp: 5.135.55.13:80 -> 217.219.168.11:2665


Files open by the process (if any):

/dev/null
/dev/null
/dev/urandom

eventpoll:[3000228]
/usr/local/lsws/logs/access.log
/usr/local/apache/logs/stderr.log
/home/delsoozc/public_html/js/window.js
/home/delsoozc/public_html/js/prototype.js
/home/farspaya/public_html/wp-content/themes/classipress4/includes/js/easyTooltip.js
/home/delsoozc/public_html/js/scriptaculous.js
/home/delsoozc/public_html/styles/etchat_white/style.css
/home/delsoozc/public_html/js/chat.js
/home/medad/public_html/clientscript/vbulletin_important.css
/home/medad/public_html/clientscript/vbulletin_menu.js
/home/delsoozc/public_html/js/builder.js
/home/farspaya/public_html/wp-content/plugins/wp-super-popup/jquery.colorbox-min.js
/home/medad/public_html/clientscript/yui/yahoo-dom-event/yahoo-dom-event.js
/home/medad/public_html/clientscript/vbulletin_global.js
/home/medad/public_html/clientscript/post_thanks.js
/home/medad/public_html/clientscript/yui/connection/connection-min.js
/home/medad/public_html/clientscript/vbulletin_post_loader.js
/usr/local/apache/logs/modsec_audit.log
/home/delsoozc/public_html/styles/default_2create_win.css
/home/mar2mak/public_html/themes/mar2mak/js/poke.js
/home/iranpato/public_html/clientscript/vbulletin-core.js
/home/delsoozc/public_html/js/dragdrop.js
/home/delsoozc/public_html/js/controls.js
/home/delsoozc/public_html/js/slider.js
/home/delsoozc/public_html/js/effects.js
/home/medad/public_html/clientscript/nice.js
/home/mar2mak/public_html/themes/mar2mak/js/inside_postform.js
/home/medad/public_html/clientscript/vbulletin_md5.js
/home/soccersh/public_html/clientscript/vbulletin_important.css
/home/delsoozc/public_html/js/sound.js
/home/farspaya/public_html/wp-content/plugins/wp-super-popup/jquery.utils-min.js
/home/soccersh/public_html/clientscript/yui/connection/connection-min.js
/home/mar2mak/public_html/themes/mar2mak/js/jquery-1.4.2.min.js
/home/soccersh/public_html/clientscript/yui/yahoo-dom-event/yahoo-dom-event.js
/home/soccersh/public_html/clientscript/vbulletin_global.js
/home/farspaya/public_html/wp-content/plugins/wp-super-popup/tiny_mce/themes/advanced/skins/default/content.css
/home/mar2mak/public_html/themes/mar2mak/css/inside.css
/home/abtincha/herasoft/themes/Meloodiuos-Sarzamin/style/style.css
/home/abtincha/herasoft/themes/Meloodiuos-Sarzamin/style/style-rtl.css
/home/irankara/public_html/wp-content/plugins/wp-pagenavi-style/css/css3_red.css
/home/medad/public_html/clientscript/vbulletin_lightbox.js
/home/irankara/public_html/wp-content/themes/20khabar/js/fancybox/jquery.fancybox-1.3.4.pack.js
/home/farspaya/public_html/wp-content/plugins/gd-star-rating/js/gdsr.js
/home/biharif/public_html/wp-content/plugins/contact-form-7/includes/js/scripts.js
/home/mar2mak/public_html/themes/mar2mak/js/inside_posts.js
/home/demescha/public_html/js/builder.js
/home/farspaya/public_html/wp-content/themes/classipress4/style.css
/home/farspaya/public_html/wp-content/uploads/smp_popup.html
/home/abtincha/herasoft/includes/ckeditor/ckeditor.js
/home/farspaya/public_html/wp-content/themes/classipress4/includes/js/theme-scripts.js
/home/moftidow/public_html/wp-content/plugins/contact-form-7/includes/css/styles.css
/home/mar2mak/public_html/themes/mar2mak/js/inside.js
/home/farspaya/public_html/wp-content/themes/classipress4/includes/js/superfish.js
/home/farspaya/public_html/wp-content/themes/classipress4/includes/js/selectbox.min.js
/home/medad/public_html/clientscript/vbulletin_attachment.js
/home/irankara/public_html/wp-content/themes/20khabar/styles/default.css
/home/abtincha/herasoft/includes/farsi.js
/home/soccersh/public_html/clientscript/vbulletin_menu.js
/home/mar2mak/public_html/themes/mar2mak/js/jscolor.js
/home/farspaya/public_html/wp-content/themes/classipress4/styles/red.css
/home/soccersh/public_html/clientscript/post_thanks.js
/home/soccersh/public_html/clientscript/vbulletin_post_loader.js
/home/farspaya/public_html/wp-content/gd-star-rating/css/rating.css
/home/abtincha/herasoft/includes/Ajax/jquery/jquery.js
/home/abtincha/herasoft/includes/ckeditor/lang/fa.js
/home/abtincha/public_html/js/controls.js
/home/abtincha/herasoft/includes/Ajax/jquery/thickbox-rtl.css
/home/farspaya/public_html/wp-content/themes/classipress4/includes/js/jcarousellite_1.0.1.js
/home/irankara/public_html/wp-content/plugins/wysija-newsletters/js/validate/languages/jquery.validationEngine-en.js
/home/farspaya/public_html/wp-content/themes/classipress4/includes/js/jquery-ui/jquery-ui-1.8.5.autocomplete.css
/home/soccersh/public_html/clientscript/vbulletin_md5.js
ntent/themes/classipress4/includes/js/easing.js
/home/farspaya/public_html/wp-includes/js/comment-reply.js
rasoft/includes/ckeditor/skins/kama/editor.css
/home/mar2mak/public_html/themes/mar2mak/js/unitpngfix.js
/home/biharif/public_html/wp-content/themes/citygraph/stylesheet.css
/home/abtincha/public_html/js/prototype.js
/home/irankara/public_html/wp-content/plugins/wysija-newsletters/js/front-subscribers.js
/home/robochat/public_html/js/scriptaculous.js
/home/robochat/public_html/styles/default_2create_win.css
/home/robochat/public_html/js/prototype.js
/home/robochat/public_html/js/chat.js
/home/robochat/public_html/styles/robochat_new/style.css
/home/robochat/public_html/js/window.js
/home/abtincha/herasoft/includes/ckeditor/plugins/styles/styles/default.js
/home/robochat/public_html/js/builder.js
/home/robochat/public_html/js/controls.js
/home/robochat/public_html/js/effects.js
/home/robochat/public_html/js/dragdrop.js
/home/robochat/public_html/js/slider.js
/home/robochat/public_html/js/sound.js
/home/irankara/public_html/wp-content/plugins/wysija-newsletters/js/validate/jquery.validationEngine.js
/home/irankara/public_html/wp-content/plugins/wysija-newsletters/css/validationEngine.jquery.css
/home/irankara/public_html/wp-content/themes/20khabar/js/jquery.cookie.js
/home/irankara/public_html/wp-content/themes/20khabar/js/jquery.corner.js
/home/irankara/public_html/wp-content/plugins/wpsubscribers/js/jquery.cookie.js
/home/irankara/public_html/wp-includes/js/tw-sack.js
/home/mar2mak/public_html/themes/mar2mak/js/vote.js
/home/abtincha/public_html/js/dragdrop.js
/home/biharif/public_html/wp-content/plugins/contact-form-7/includes/css/styles.css
/home/abtincha/public_html/js/scriptaculous.js
/home/abtincha/public_html/js/builder.js
/home/abtincha/public_html/js/effects.js
/home/abtincha/public_html/js/slider.js
/home/abtincha/public_html/js/login.js
/home/abtincha/public_html/js/sound.js
/home/biharif/public_html/wp-includes/js/jquery/jquery.js
/home/robochat/public_html/styles/robochat_new/robo.css
/home/robochat/public_html/js/login.js
/home/biharif/public_html/wp-content/plugins/contact-form-7/includes/js/jquery.form.js
/home/biharif/public_html/wp-content/themes/citygraph/style_002.css
/home/biharif/public_html/wp-content/themes/citygraph/rtl.css
/home/biharif/public_html/wp-content/themes/citygraph/style.css
/home/delsoozc/public_html/js/login.js

[ertebat7]

وقتی لایت اسپید را خاموش می کنم این ایمیل ها دیگه نمیاد
هر چی هست مشکل از لایت اسپیده

[ertebat7]

خب مشکل توسط پشتیبانی لایت اسپید توضیح داده شده
و علتش هم اپدیت لایت اسپید عنوان کرده راهکار هم در پست دوم ارائه کرده است

http://www.litespeedtech.com/support/forum/showthread.php?t=2371

این هم برای دوستانی که ممکنه با این مشکل روبرو بشند در اینده