Suspicious process running under user

mamayukero

• December 14, 2018 01:25

Hi, I got an error and often this message appears. like this: Time: Fri Dec 14 11:47:11 2018 +0700 PID: 3132 (Parent PID:4543) Account: ...... Uptime: 110 seconds Executable: /opt/cpanel/ea-php70/root/usr/sbin/php-fpm Command Line (often faked in exploits): php-fpm: pool ..... Network connections by the process (if any): tcp: ..... Files open by the process (if any): /tmp/.ZendSem.zyMTxg (deleted) /dev/urandom Memory maps by the process (if any): . . . . . . 7f586e408000-7f586e42d000 rw-p 00000000 00:00 0 7f586e42d000-7f586e462000 r--s 00000000 b6:4a5b1 550428 /var/db/nscd/hosts 7f586e462000-7f586e4e6000 rw-p 00000000 00:00 0 7f586e4ef000-7f586e4f1000 rw-s 00000000 00:04 2095223666 /dev/zero (deleted) 7f586e4f1000-7f586e4f2000 rw-p 00000000 00:00 0 7f586e4f2000-7f586e4f3000 r--p 00021000 b6:4a5b1 395545 /usr/lib64/ld-2.17.so 7f586e4f3000-7f586e4f4000 rw-p 00022000 b6:4a5b1 395545 /usr/lib64/ld-2.17.so 7f586e4f4000-7f586e4f5000 rw-p 00000000 00:00 0 7ffea8c64000-7ffea8c85000 rw-p 00000000 00:00 0 [stack] 7ffea8df9000-7ffea8dfb000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] Can anyone explain and help me?

• 

  rpvw

  • December 14, 2018 09:27

  Add the following line to to your /etc/csf/csf.pignore file pexe:/opt/cpanel/ea-php*/root/usr/sbin/php-fpm
  Click Change and then Restart lfd

  0
• 

  cPanelLauren

  • December 17, 2018 19:50

  Hello, In addition to what @rpvw noted the following resource may be useful as well: Thanks!

  0

Please sign in to leave a comment.