The process loads the processor under 100%, how to get rid of it?

Question

linux

Guys, there is a VPS server with Centos 6.7 and so such a trouble appeared, every 5 times a day a process appears from the user (ispmanager on which the sites hang) the process loads the usr/bin/host file. According to htop, there are 10-20 of them, but the top one loads both cores at 100% of which and the sites fall.
It seems to me that someone uses a server for their own purposes for ddos, for example, what can be done, has anyone come across?
UPD: screenshot https://yadi.sk/i/1IIJxP6hoCUet

Answer 1

Here, frankly speaking, you can’t say anything so quickly and you need to look in detail on the spot, but you can see what this process does in general by connecting to it using strace.
# strace -p xxxxxx -s 80 -o /tmp/debug.txt
-p is the pid of the process.
The file will contain a carload of information, after analyzing which you can understand what is happening there.

Answer 2

usr/bin/host is a well-known virus, it either sends spam, or brutes ssh, I don’t remember offhand.
ls -la /proc/$pid/fd , then kill the process and fix your broken sites. Well, check that proftpd is not full of holes, right away.