my server is hacked/flooded, please help

hi, currently the server load is 32.74/4 whereas normally it's only ~3 or 4.

When I check the current CPU usage, it shows tons of processes:

29045 mailnull 0 0.0 0.0 2 exim
29991 mailnull 0 0.0 0.0 0 exim
29992 mailnull 0 0.0 0.0 3 exim
30268 mailnull 0 0.0 0.0 3 exim
30279 mailnull 0 0.0 0.0 2 exim
30281 mailnull 0 0.0 0.0 2 exim
30294 mailnull 0 0.0 0.0 0 exim
30316 mailnull 0 0.0 0.0 1 exim
30320 mailnull 0 0.0 0.0 3 exim
30327 mailnull 0 0.0 0.0 1 exim
30334 mailnull 0 0.0 0.0 1 exim
30337 mailnull 0 0.0 0.0 2 exim
30430 mailnull 0 0.0 0.0 2 exim
30447 mailnull 0 0.0 0.0 2 exim
30542 mailnull 0 0.0 0.0 0 exim
30679 mailnull 0 0.0 0.0 1 exim
30684 mailnull 0 0.0 0.0 2 exim
30685 mailnull 0 0.0 0.0 1 exim
30688 mailnull 0 0.0 0.0 3 exim
....
....

I tried to kill them all but no help, after like 5 seconds they're all back. Look like they are executed by a CRON.

please help me how to trace down the cron and how to fix it

thanks a lot

 

 

 

 

Top