Please help. Many threads in my server

[Lim]

Hi,

I have many threads in my server, please help.

1. The antivirus software failure
I always get this email around 500 emails daily. Its title is "The antivirus software failure". Here is detail
FROM: DrWeb-DAEMON
------------start-------------
Dear Postmaster,

the message with following attributes has not been delivered,
because contains an object which cannot be checked by antivirus.

Sender = [email protected]
Recipients = [email protected]
Subject = Your free trial of the most nutricious and powerful food on the planet Acai Berry
Message-ID = <000d01ca0a45$e3ddb720$6400a8c0@nanoseconds27>

--- Dr.Web report ---
Dr.Web detailed report:
The filter cannot connect to the DrWEB daemon

--- Dr.Web report ---

The original message was stored in archive record named:
file was not created
---------------end-----------------

2. SMART error
I always get this email around 150 emails daily. Its title is "SMART error (OfflineUncorrectableSector) detected on host: limparty.com". Here is detail
From: [email protected]
---------------start----------------
This email was generated by the smartd daemon running on:

host name: limparty.com
DNS domain: com
NIS domain: (none)

The following warning/error was logged by the smartd daemon:

Device: /dev/sda, 567 Offline uncorrectable sectors

For details see host's SYSLOG (default: /var/log/messages).

You can also use the smartctl utility for further investigation.
No additional email messages about this problem will be sent.
---------------end----------------

3.If someone go the missing link, they will redirect to spam website (securityexamineonline[dot]com/scan[dot]php[question]affid[equal]18800). This is the most critical. I used to be banded by google.com. I do not want it again. Please help.

Thank you very much in advanced.
Limparty

ps. you cannot ping my server. Firewall is opened.

 

[ThomasR]

Hi Lim,

Concerning your third question, check http://blog.unmaskparasites.com/200...ts-about-malicious-server-wide-meta-redirects.

 

[Lim]

Thank you

Thank you very much for your help.

I will post the solution after I can solve it.

 

[atomicturtle]

1) This is being caused because the drweb daemon is not running.

2) Indicates that you have a failing disk, /dev/sda

and

3) Look for .htaccess files in your sites documentroot, these might contain redirects to the site in question. It would indicate to me that those sites on your systems have been compromised by a malicious 3rd party.