And I only experienced this with a friend today.
I have a server and I let my friend host his Opencart to my server. His is 3.0.3.3
I am using CWP and HestiaCP. He was hosted in CWP this morning and I moved his site to HestiaCP
He contacted this morning saying his website is slow.
I logged on the server (CWP) and saw his user eating 100% of the CPU. 2 core CPU
![Image](https://scontent.fmnl17-2.fna.fbcdn.net/v/t39.30808-6/272552007_6907127592693921_7117066914521736607_n.jpg?_nc_cat=102&ccb=1-5&_nc_sid=730e14&_nc_eui2=AeHzM-S0gDskWKsumqI7p-sOC77a1g_AB8gLvtrWD8AHyKiY7i91SL2wHqZW2OhfhzJcbaSIRbYs8zFIDmF2vIA9&_nc_ohc=gnsflRpRPdsAX-NJgPD&_nc_ht=scontent.fmnl17-2.fna&oh=00_AT-IphnRfwlu6VXaORZxDNa_D30bV5XO4L9q3fVAMIiWYw&oe=61F44007)
I logged on to his files and saw some malicious symlinks. Wordpress related and it is symlinking to itself, creating an infinite loop where I cannot even cat the files. So I deleted them all.
Transferred his site and db to HestiaCP. No too long after, its eating the CPU 100% once again.
Here's the thing, I am seeing 2 malicious files once again. And it keeps generating inside the Admin folder.
prm_json_array.txt
sop_json_array.txt
So what I did is reuploaded the core files (3.0.3.8 upgrade) into the server.
Disabled all modification and see if CPU utilization will die down. Nothing.
There are no new extensions installed by the way since November. And extensions are just a few, tried and tested on my own Opencart websites.
The 2 files once again are still being generated.
So I upgraded the VPS to 8 core CPU. Hoping that its trying to do some processes that needs to be finished. So an 8 core CPU might help to finish it.
At 8 core, utilization is at 50%
At this point, I will just wait for the process to finish, hoping it will just fix itself.
Friend does not have any cron jobs BTW
Bandwidth? It's normal. So I guess this isnt a DDOS attack.
But I am creating this thread if anyone is familiar with the 2 malicious files that keeps generating.
prm_json_array.txt
sop_json_array.txt
EDIT:
Confirmed that 2 files above are module related.
I do still have a problem with CPU utilization.