list of updated files includes eggdrop.sym, ircd.sym and other suspicious files

jeffschips

• November 02, 2021 23:28

Hello. I normally receive updates on files not matching md5sums and check if it was the result of an update. But today I received a list of updated files the likes of the following: [2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/BitchX.sym ..Done [2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/bnc.sym ..Done [2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/eggdrop.sym ..Done [2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/generic-sniffers.sym ..Done [2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/guardservices.sym ..Done [2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/ircd.sym ..Done [2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/psyBNC.sym ..Done [2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/ptlink.sym ..Done [2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/services.sym ..Done
What the heck is this stuff? bitchX.sym, generic-sniffers.sym? When attemtping to contact and log a report with cpanel can't get into the client portal.

• 

  quietFinn

  • November 03, 2021 09:31

  I believe those have something to do with "Backgroud Process Killer", WHM -> System Health -> Backgroud Process Killer

  0
• 

  cPanelAnthony

  • November 03, 2021 14:08

  Hello! While you would ultimately want to confirm that these files are legitimate with a systems administrator, "BitchX" is actually legitimate software; it appears to be an IRC.

  0
• 

  quietFinn

  • November 03, 2021 14:21

  More info here:

  0
• 

  jeffschips

  • November 04, 2021 14:18

  SOLVED: those files with ominous-sounding names are in fact symbolic links to services that monitor *for* those miscreant services. They are *not* the services themselves.

  0
• 

  cPanelAnthony

  • November 04, 2021 14:55

  Thank you for this confirmatiton! It is good information to have.

  0

Please sign in to leave a comment.