Something strange happening with my services

[teodorsavic]

Hi,
Today I ran `sh /script/restart-all` and I got this result:
`Stopping mysqld:                                           [  OK  ]
Starting mysqld:                                           [  OK  ]
Stopping named: .                                          [  OK  ]
Starting named:                                            [  OK  ]
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
Stopping qmail-toaster: svscan qmail logging.
qmail-send: no process killed
Starting qmail-toaster: svscan.
Stopping xinetd:                                           [  OK  ]
Starting xinetd:                                           [  OK  ]
Stopping kloxo-phpcgi:                                     [  OK  ]
Starting kloxo-phpcgi:                                     [  OK  ]
Stopping kloxo-hiawatha:                                   [  OK  ]
Starting kloxo-hiawatha:                                   [  OK  ]
Stopping php-fpm:                                          [  OK  ]
Starting php-fpm:                                          [  OK  ]`

I'm sure that there wasn't `xinetd` or `kloxo-phpcgi` the last time I restarted my services. Instead of them there was `bind` I believe. The last ssh login was from my IP address 7 days ago and `Login History` in KloxoMR shows only my 2 IP addresses. The only thing I've changed in the last 10 days was upgrading from PHP 5.3 to PHP 5.4.
Do you know what is happening here?

[MRatWork]

Restart process will detecting certain services state are 'on' or not. So, it's possible Kloxo-MR change the state of certain services (in your case are xinetd). Don't worry about it.

[teodorsavic]

But it never happened until now. And also, I noticed that the server uses much more RAM memory than before. Almost twice the amount it used before. It's somewhere around 1 - 1.1GB Real Memory on idle now. And it was around 600mb before. Is this somehow connected?

[MRatWork]

inform here 'sh /script/sysinfo; cat /etc/my.cnf'.

[teodorsavic]

A. Kloxo-MR: 6.5.0.f-2015010801

B. OS: CentOS release 6.6 (Final) x86_64

C. Apps:
   1. MySQL: mysql55-5.5.42-1.ius.el6.x86_64
   2. PHP: php54-5.4.38-1.ius.el6.x86_64
   3. Httpd: httpd-2.2.29-1.mr.el6.x86_64
   4. Lighttpd: --uninstalled--
   5. Nginx: --uninstalled--
   6. Qmail: qmail-toaster-1.03-1.3.46.mr.el6.x86_64
      - with: courier-imap-toaster-4.1.2-1.3.18.mr.el6.x86_64
   7. Dns: bind-9.9.5-1.el6.x86_64

D. Php-type (for Httpd/proxy): php-fpm_event

E. Memory:
                total       used       free     shared    buffers     cached
   Mem:         15638       2226      13412          0        171        647
   -/+ buffers/cache:       1406      14232
   Swap:         8191          0       8191

[teodorsavic]

[mysqld]
#OpenVZ AIO bug fix
innodb_use_native_aio=0

## General
datadir                         = /var/lib/mysql
tmpdir                          = /var/lib/mysqltmp
socket                          = /var/lib/mysql/mysql.sock
skip-name-resolve
sql-mode                        = NO_ENGINE_SUBSTITUTION
#event-scheduler                = 1

## Cache
thread-cache-size               = 16
table-open-cache                = 4096
table-definition-cache          = 2048
query-cache-size                = 32M
query-cache-limit               = 1M

## Per-thread Buffers
sort-buffer-size                = 1M
read-buffer-size                = 1M
read-rnd-buffer-size            = 1M
join-buffer-size                = 1M

## Temp Tables
tmp-table-size                  = 32M
max-heap-table-size             = 64M

## Networking
back-log                        = 100
#max-connections                = 200
max-connect-errors              = 10000
max-allowed-packet              = 16M
interactive-timeout             = 3600
wait-timeout                    = 600

### Storage Engines
#default-storage-engine         = InnoDB
innodb                          = FORCE

## MyISAM
key-buffer-size                 = 64M
myisam-sort-buffer-size         = 128M

## InnoDB
#innodb-buffer-pool-size        = 128M
#innodb-log-file-size           = 100M
#innodb-log-buffer-size         = 8M
#innodb-file-per-table          = 1
#innodb-open-files              = 300

## Replication
server-id                       = 1
#log-bin                        = /var/log/mysql/bin-log
#relay-log                      = /var/log/mysql/relay-log
relay-log-space-limit           = 16G
expire-logs-days                = 7
#read-only                      = 1
#sync-binlog                    = 1
#log-slave-updates              = 1
#binlog-format                  = STATEMENT
#auto-increment-offset          = 1
#auto-increment-increment       = 2

## Logging
#log-output                      = FILE
#slow-query-log                  = 1
#slow-query-log-file             = /var/log/mysql/slow-log
#log-slow-slave-statements
#long-query-time                 = 2

[mysqld_safe]
log-error                       = /var/log/mysqld.log
open-files-limit                = 65535

[mysql]
no-auto-rehash

[MRatWork]

It's because your mysql is innodb enable. Run 'sh /script/mysql-convert --engine=myisam'.

[teodorsavic]

I don't think so.. My CPU and RAM usage doubled in the past 3 days. I looked through the security logs and  found "Rootkit Hunter: Please inspect this machine, because it may be infected."
Also, this morning I got an email from kloxo@myserver.com with : "Port: 25, Action: /etc/init.d/qmail restart". Many other strange things are happening in the last two days.
I did all the recommended CentOS hardening, changed the ports, disabled root, lxguard enabled etc..
Is there any way to cleanup this mess?