Hosting / Server Maintenance Fix

Project Overview :
We've recently have had a backend issue with my main website. After speaking to the hosting admins, they provided me with the following fix instructions in which I would need someone to perform.

Task Description :
Essentially we need someone who is well versed in hosting / server / website management to perform this fix. If interested, please read the below analysis, and provide your written breakdown of the solution that you will perform, and your accurate timeframe to fix if provided the job.

------------------------------------------------------------------------------------------

During our investigation, we identified multiple issues affecting the server’s stability:

? The root (/) partition was full. To address this, I truncated a duplicate log file. The partition is currently at 90?pacity.

? The /tmp directory was in a read-only state. I have recreated /tmp and restarted the necessary services. WHM should be accessible now.

? However, shortly after the restart, the server experienced a load spike and ran out of memory. This triggered the out-of-memory killer (oom-killer) to terminate the Apache process in order to reduce the load.

Further investigation revealed multiple instances of a script running from the account zere86ro:

lsphp:/home/zere86ro/public_ ---------- p

Killing these processes only caused new ones to spawn, indicating suspicious activity. A malware scan confirmed that the account is infected. The scan results are available in the file /home/zere86ro/malware.txt.

To prevent the server from becoming unresponsive again, I changed the permissions of /home/zere86ro/public_ ---------- p to 000. Please note that once the account is cleaned and secured, it is advisable to reset the permissions back to 644 via the cPanel's File Manager.

? Additionally, we detected mass spam email activity originating from the email address ---------- on May 16, 2026, with over 1.27 million emails sent on that day. I have attached a file containing a summary of emails sent during the past 20 days for your reference.

To mitigate the impact, I strongly recommend that you:
Reset the account, all mailbox, and FTP passwords.
Clean all infected files from the account to prevent further issues.
I hope this email has covered all the necessary information. If you have any additional questions or concerns, please feel free to let us know. We will be happy to assist you.