I have a huge problem. In a nut shell, 2 days ago I noted a strange process going on with httpd, something I never saw before. That then led to me googling it, and OVH came up top with "Examples of a hacked server" So I freaked out, but didn't do anything as the rest of cpanel forums said it wasn't related to hacks.
And here we are, I'm unable to log in to root, as if my pass was changed. I have standard user accounts which have no root access but have SSH access. The server is running CentOS 6.2.
Ok, I booted to single user mode and was able to reset my password from there. Now I have root access back, but only for 5-10 mins as it gets changed again right after booting up. I scanned for rootkits and found nothing, and am doing a clamav scan which isnt bringing up much either. Luckily I connected to root SSH terminal right before it got changed, so I have no WHM access but I do have SSH root access until I disconnect.
I'm posting here requesting help and advice on what I should do here. Thanks, Kris