Author Topic: Suspicious process running under user %username% (Read 15180 times)

Riccardo90 · « **on:** March 07, 2016, 06:35:52 PM »

Hello,
I have a problem with my CWP installation because from some days i continue to receive an email with the suspicious alert in the folder /usr/local/bin/php-cgi

I removed all the files of last uploaded websites and tried to block the destination IPs via CFS without success.

Could you please help me to find the cause and found a solution in order to fix that issue or better, help me to do an advanced troubleshooting?

Thank you very much
Regards
Riccardo

Sandeep · « **Reply #1 on:** March 08, 2016, 12:57:14 PM »

can you add the log/ name of the suspicious file. Most of the time its a false positive

Riccardo90 · « **Reply #2 on:** March 10, 2016, 08:58:37 AM »

Hello,
Thanks for your response.. this is the email message that i receive:

Time: Thu Mar 10 09:48:22 2016 +0100
PID: 17128 (Parent PID:16599)
Account: MyUsername
Uptime: 71 seconds

Executable:

/usr/local/bin/php-cgi

Command Line (often faked in exploits):

/usr/local/bin/php-cgi

Network connections by the process (if any):

tcp: MyServerIP:38911 -> 91.240.109.36:80

Files open by the process (if any):

Memory maps by the process (if any):

00400000-00e5f000 r-xp 00000000 fd:00 175243502 /usr/local/bin/php-cgi
0105f000-01126000 rw-p 00a5f000 fd:00 175243502 /usr/local/bin/php-cgi
01126000-0114a000 rw-p 00000000 00:00 0
02418000-02fae000 rw-p 00000000 00:00 0 [heap]
7fbad9362000-7fbad9367000 r-xp 00000000 fd:00 175247598 /lib64/libnss_dns-2.12.so
7fbad9367000-7fbad9566000 ---p 00005000 fd:00 175247598 /lib64/libnss_dns-2.12.so
7fbad9566000-7fbad9567000 r--p 00004000 fd:00 175247598 /lib64/libnss_dns-2.12.so
7fbad9567000-7fbad9568000 rw-p 00005000 fd:00 175247598 /lib64/libnss_dns-2.12.so
7fbad9568000-7fbad9574000 r-xp 00000000 fd:00 175247463 /lib64/libnss_files-2.12.so
7fbad9574000-7fbad9774000 ---p 0000c000 fd:00 175247463 /lib64/libnss_files-2.12.so
7fbad9774000-7fbad9775000 r--p 0000c000 fd:00 175247463 /lib64/libnss_files-2.12.so
7fbad9775000-7fbad9776000 rw-p 0000d000 fd:00 175247463 /lib64/libnss_files-2.12.so
7fbad9776000-7fbad98f8000 rw-p 00000000 00:00 0
7fbad9970000-7fbad99b1000 rw-p 00000000 00:00 0
7fbad99b1000-7fbadf842000 r--p 00000000 fd:00 175250802 /usr/lib/locale/locale-archive-rpm
7fbadf842000-7fbadfb2e000 rw-p 00000000 00:00 0
7fbadfb4e000-7fbadfbd0000 rw-p 00000000 00:00 0
7fbadfbd4000-7fbadfc15000 rw-p 00000000 00:00 0
7fbadfc19000-7fbae00aa000 rw-p 00000000 00:00 0
7fbae00cb000-7fbae018e000 rw-p 00000000 00:00 0
7fbae01a5000-7fbae01c2000 r-xp 00000000 fd:00 175247684 /lib64/libselinux.so.1
7fbae01c2000-7fbae03c1000 ---p 0001d000 fd:00 175247684 /lib64/libselinux.so.1
7fbae03c1000-7fbae03c2000 r--p 0001c000 fd:00 175247684 /lib64/libselinux.so.1
7fbae03c2000-7fbae03c3000 rw-p 0001d000 fd:00 175247684 /lib64/libselinux.so.1
7fbae03c3000-7fbae03c4000 rw-p 00000000 00:00 0
7fbae03c4000-7fbae03dd000 r-xp 00000000 fd:00 175250231 /usr/lib64/libsasl2.so.2.0.23
7fbae03dd000-7fbae05dc000 ---p 00019000 fd:00 175250231 /usr/lib64/libsasl2.so.2.0.23
7fbae05dc000-7fbae05dd000 r--p 00018000 fd:00 175250231 /usr/lib64/libsasl2.so.2.0.23
7fbae05dd000-7fbae05de000 rw-p 00019000 fd:00 175250231 /usr/lib64/libsasl2.so.2.0.23
7fbae05de000-7fbae05ec000 r-xp 00000000 fd:00 175247688 /lib64/liblber-2.4.so.2.10.3
7fbae05ec000-7fbae07eb000 ---p 0000e000 fd:00 175247688 /lib64/liblber-2.4.so.2.10.3
7fbae07eb000-7fbae07ec000 r--p 0000d000 fd:00 175247688 /lib64/liblber-2.4.so.2.10.3
7fbae07ec000-7fbae07ed000 rw-p 0000e000 fd:00 175247688 /lib64/liblber-2.4.so.2.10.3
7fbae07ed000-7fbae07ef000 r-xp 00000000 fd:00 175247452 /lib64/libkeyutils.so.1.3
7fbae07ef000-7fbae09ee000 ---p 00002000 fd:00 175247452 /lib64/libkeyutils.so.1.3
7fbae09ee000-7fbae09ef000 r--p 00001000 fd:00 175247452 /lib64/libkeyutils.so.1.3
7fbae09ef000-7fbae09f0000 rw-p 00002000 fd:00 175247452 /lib64/libkeyutils.so.1.3
7fbae09f0000-7fbae09fa000 r-xp 00000000 fd:00 175247411 /lib64/libkrb5support.so.0.1
7fbae09fa000-7fbae0bf9000 ---p 0000a000 fd:00 175247411 /lib64/libkrb5support.so.0.1
7fbae0bf9000-7fbae0bfa000 r--p 00009000 fd:00 175247411 /lib64/libkrb5support.so.0.1
7fbae0bfa000-7fbae0bfb000 rw-p 0000a000 fd:00 175247411 /lib64/libkrb5support.so.0.1
7fbae0bfb000-7fbae0c22000 r-xp 00000000 fd:00 175249478 /usr/lib64/libssh2.so.1.0.1
7fbae0c22000-7fbae0e21000 ---p 00027000 fd:00 175249478 /usr/lib64/libssh2.so.1.0.1
7fbae0e21000-7fbae0e23000 rw-p 00026000 fd:00 175249478 /usr/lib64/libssh2.so.1.0.1
7fbae0e23000-7fbae0e5c000 r-xp 00000000 fd:00 175249466 /lib64/libnspr4.so
7fbae0e5c000-7fbae105c000 ---p 00039000 fd:00 175249466 /lib64/libnspr4.so
7fbae105c000-7fbae105d000 r--p 00039000 fd:00 175249466 /lib64/libnspr4.so
7fbae105d000-7fbae105f000 rw-p 0003a000 fd:00 175249466 /lib64/libnspr4.so
7fbae105f000-7fbae1061000 rw-p 00000000 00:00 0
7fbae1061000-7fbae1065000 r-xp 00000000 fd:00 175251479 /lib64/libplc4.so
7fbae1065000-7fbae1264000 ---p 00004000 fd:00 175251479 /lib64/libplc4.so
7fbae1264000-7fbae1265000 r--p 00003000 fd:00 175251479 /lib64/libplc4.so
7fbae1265000-7fbae1266000 rw-p 00004000 fd:00 175251479 /lib64/libplc4.so
7fbae1266000-7fbae1269000 r-xp 00000000 fd:00 175251480 /lib64/libplds4.so
7fbae1269000-7fbae1468000 ---p 00003000 fd:00 175251480 /lib64/libplds4.so
7fbae1468000-7fbae1469000 r--p 00002000 fd:00 175251480 /lib64/libplds4.so
7fbae1469000-7fbae146a000 rw-p 00003000 fd:00 175251480 /lib64/libplds4.so
7fbae146a000-7fbae1490000 r-xp 00000000 fd:00 175250676 /usr/lib64/libnssutil3.so
7fbae1490000-7fbae168f000 ---p 00026000 fd:00 175250676 /usr/lib64/libnssutil3.so
7fbae168f000-7fbae1695000 r--p 00025000 fd:00 175250676 /usr/lib64/libnssutil3.so
7fbae1695000-7fbae1696000 rw-p 0002b000 fd:00 175250676 /usr/lib64/libnssutil3.so
7fbae1696000-7fbae17cd000 r-xp 00000000 fd:00 175246792 /usr/lib64/libnss3.so
7fbae17cd000-7fbae19cc000 ---p 00137000 fd:00 175246792 /usr/lib64/libnss3.so
7fbae19cc000-7fbae19d1000 r--p 00136000 fd:00 175246792 /usr/lib64/libnss3.so
7fbae19d1000-7fbae19d3000 rw-p 0013b000 fd:00 175246792 /usr/lib64/libnss3.so
7fbae19d3000-7fbae19d5000 rw-p 00000000 00:00 0
7fbae19d5000-7fbae19fd000 r-xp 00000000 fd:00 175250235 /usr/lib64/libsmime3.so
7fbae19fd000-7fbae1bfc000 ---p 00028000 fd:00 175250235 /usr/lib64/libsmime3.so
7fbae1bfc000-7fbae1c00000 r--p 00027000 fd:00 175250235 /usr/lib64/libsmime3.so
7fbae1c00000-7fbae1c01000 rw-p 0002b000 fd:00 175250235 /usr/lib64/libsmime3.so
7fbae1c01000-7fbae1c3c000 r-xp 00000000 fd:00 175251629 /usr/lib64/libssl3.so
7fbae1c3c000-7fbae1e3c000 ---p 0003b000 fd:00 175251629 /usr/lib64/libssl3.so
7fbae1e3c000-7fbae1e3f000 r--p 0003b000 fd:00 175251629 /usr/lib64/libssl3.so
7fbae1e3f000-7fbae1e40000 rw-p 0003e000 fd:00 175251629 /usr/lib64/libssl3.so
7fbae1e40000-7fbae1e41000 rw-p 00000000 00:00 0
7fbae1e41000-7fbae1e8e000 r-xp 00000000 fd:00 175247622 /lib64/libldap-2.4.so.2.10.3
7fbae1e8e000-7fbae208d000 ---p 0004d000 fd:00 175247622 /lib64/libldap-2.4.so.2.10.3
7fbae208d000-7fbae208f000 r--p 0004c000 fd:00 175247622 /lib64/libldap-2.4.so.2.10.3
7fbae208f000-7fbae2091000 rw-p 0004e000 fd:00 175247622 /lib64/libldap-2.4.so.2.10.3
7fbae2091000-7fbae20c3000 r-xp 00000000 fd:00 175247379 /lib64/libidn.so.11.6.1
7fbae20c3000-7fbae22c2000 ---p 00032000 fd:00 175247379 /lib64/libidn.so.11.6.1
7fbae22c2000-7fbae22c3000 rw-p 00031000 fd:00 175247379 /lib64/libidn.so.11.6.1
7fbae22c3000-7fbae22da000 r-xp 00000000 fd:00 175247363 /lib64/libpthread-2.12.so
7fbae22da000-7fbae24da000 ---p 00017000 fd:00 175247363 /lib64/libpthread-2.12.so
7fbae24da000-7fbae24db000 r--p 00017000 fd:00 175247363 /lib64/libpthread-2.12.so
7fbae24db000-7fbae24dc000 rw-p 00018000 fd:00 175247363 /lib64/libpthread-2.12.so
7fbae24dc000-7fbae24e0000 rw-p 00000000 00:00 0
7fbae24e0000-7fbae24e3000 r-xp 00000000 fd:00 175247416 /lib64/libgpg-error.so.0.5.0
7fbae24e3000-7fbae26e2000 ---p 00003000 fd:00 175247416 /lib64/libgpg-error.so.0.5.0
7fbae26e2000-7fbae26e3000 r--p 00002000 fd:00 175247416 /lib64/libgpg-error.so.0.5.0
7fbae26e3000-7fbae26e4000 rw-p 00003000 fd:00 175247416 /lib64/libgpg-error.so.0.5.0
7fbae26e4000-7fbae2756000 r-xp 00000000 fd:00 175247430 /lib64/libgcrypt.so.11.5.3
7fbae2756000-7fbae2955000 ---p 00072000 fd:00 175247430 /lib64/libgcrypt.so.11.5.3
7fbae2955000-7fbae2956000 r--p 00071000 fd:00 175247430 /lib64/libgcrypt.so.11.5.3
7fbae2956000-7fbae2959000 rw-p 00072000 fd:00 175247430 /lib64/libgcrypt.so.11.5.3
7fbae2959000-7fbae295b000 r-xp 00000000 fd:00 175243333 /lib64/libfreebl3.so
7fbae295b000-7fbae2b5a000 ---p 00002000 fd:00 175243333 /lib64/libfreebl3.so
7fbae2b5a000-7fbae2b5b000 r--p 00001000 fd:00 175243333 /lib64/libfreebl3.so
7fbae2b5b000-7fbae2b5c000 rw-p 00002000 fd:00 175243333 /lib64/libfreebl3.so
7fbae2b5c000-7fbae2b72000 r-xp 00000000 fd:00 175247694 /lib64/libresolv-2.12.so
7fbae2b72000-7fbae2d72000 ---p 00016000 fd:00 175247694 /lib64/libresolv-2.12.so
7fbae2d72000-7fbae2d73000 r--p 00016000 fd:00 175247694 /lib64/libresolv-2.12.so
7fbae2d73000-7fbae2d74000 rw-p 00017000 fd:00 175247694 /lib64/libresolv-2.12.so
7fbae2d74000-7fbae2d76000 rw-p 00000000 00:00 0
7fbae2d76000-7fbae2f00000 r-xp 00000000 fd:00 175247434 /lib64/libc-2.12.so
7fbae2f00000-7fbae3100000 ---p 0018a000 fd:00 175247434 /lib64/libc-2.12.so
7fbae3100000-7fbae3104000 r--p 0018a000 fd:00 175247434 /lib64/libc-2.12.so
7fbae3104000-7fbae3105000 rw-p 0018e000 fd:00 175247434 /lib64/libc-2.12.so
7fbae3105000-7fbae310a000 rw-p 00000000 00:00 0
7fbae310a000-7fbae3145000 r-xp 00000000 fd:00 175252307 /usr/lib64/libxslt.so.1.1.26
7fbae3145000-7fbae3345000 ---p 0003b000 fd:00 175252307 /usr/lib64/libxslt.so.1.1.26
7fbae3345000-7fbae3347000 rw-p 0003b000 fd:00 175252307 /usr/lib64/libxslt.so.1.1.26
7fbae3347000-7fbae33df000 r-xp 00000000 fd:00 175253176 /usr/lib64/libfreetype.so.6.3.22
7fbae33df000-7fbae35de000 ---p 00098000 fd:00 175253176 /usr/lib64/libfreetype.so.6.3.22
7fbae35de000-7fbae35e4000 rw-p 00097000 fd:00 175253176 /usr/lib64/libfreetype.so.6.3.22
7fbae35e4000-7fbae379d000 r-xp 00000000 fd:00 175250659 /usr/lib64/libcrypto.so.1.0.1e
7fbae379d000-7fbae399c000 ---p 001b9000 fd:00 175250659 /usr/lib64/libcrypto.so.1.0.1e
7fbae399c000-7fbae39b7000 r--p 001b8000 fd:00 175250659 /usr/lib64/libcrypto.so.1.0.1e
7fbae39b7000-7fbae39c3000 rw-p 001d3000 fd:00 175250659 /usr/lib64/libcrypto.so.1.0.1e
7fbae39c3000-7fbae39c7000 rw-p 00000000 00:00 0
7fbae39c7000-7fbae3a29000 r-xp 00000000 fd:00 175250254 /usr/lib64/libssl.so.1.0.1e
7fbae3a29000-7fbae3c28000 ---p 00062000 fd:00 175250254 /usr/lib64/libssl.so.1.0.1e
7fbae3c28000-7fbae3c2c000 r--p 00061000 fd:00 175250254 /usr/lib64/libssl.so.1.0.1e
7fbae3c2c000-7fbae3c33000 rw-p 00065000 fd:00 175250254 /usr/lib64/libssl.so.1.0.1e
7fbae3c33000-7fbae3c36000 r-xp 00000000 fd:00 175247497 /lib64/libcom_err.so.2.1
7fbae3c36000-7fbae3e35000 ---p 00003000 fd:00 175247497 /lib64/libcom_err.so.2.1
7fbae3e35000-7fbae3e36000 r--p 00002000 fd:00 175247497 /lib64/libcom_err.so.2.1
7fbae3e36000-7fbae3e37000 rw-p 00003000 fd:00 175247497 /lib64/libcom_err.so.2.1
7fbae3e37000-7fbae3e60000 r-xp 00000000 fd:00 175247442 /lib64/libk5crypto.so.3.1
7fbae3e60000-7fbae4060000 ---p 00029000 fd:00 175247442 /lib64/libk5crypto.so.3.1
7fbae4060000-7fbae4061000 r--p 00029000 fd:00 175247442 /lib64/libk5crypto.so.3.1
7fbae4061000-7fbae4062000 rw-p 0002a000 fd:00 175247442 /lib64/libk5crypto.so.3.1
7fbae4062000-7fbae4063000 rw-p 00000000 00:00 0
7fbae4063000-7fbae413e000 r-xp 00000000 fd:00 175247593 /lib64/libkrb5.so.3.3
7fbae413e000-7fbae433e000 ---p 000db000 fd:00 175247593 /lib64/libkrb5.so.3.3
7fbae433e000-7fbae4348000 r--p 000db000 fd:00 175247593 /lib64/libkrb5.so.3.3
7fbae4348000-7fbae434a000 rw-p 000e5000 fd:00 175247593 /lib64/libkrb5.so.3.3
7fbae434a000-7fbae438b000 r-xp 00000000 fd:00 175247364 /lib64/libgssapi_krb5.so.2.2
7fbae438b000-7fbae458b000 ---p 00041000 fd:00 175247364 /lib64/libgssapi_krb5.so.2.2
7fbae458b000-7fbae458c000 r--p 00041000 fd:00 175247364 /lib64/libgssapi_krb5.so.2.2
7fbae458c000-7fbae458e000 rw-p 00042000 fd:00 175247364 /lib64/libgssapi_krb5.so.2.2
7fbae458e000-7fbae46d7000 r-xp 00000000 fd:00 175250232 /usr/lib64/libxml2.so.2.7.6
7fbae46d7000-7fbae48d6000 ---p 00149000 fd:00 175250232 /usr/lib64/libxml2.so.2.7.6
7fbae48d6000-7fbae48e0000 rw-p 00148000 fd:00 175250232 /usr/lib64/libxml2.so.2.7.6
7fbae48e0000-7fbae48e1000 rw-p 00000000 00:00 0
7fbae48e1000-7fbae48f7000 r-xp 00000000 fd:00 175247426 /lib64/libnsl-2.12.so
7fbae48f7000-7fbae4af6000 ---p 00016000 fd:00 175247426 /lib64/libnsl-2.12.so
7fbae4af6000-7fbae4af7000 r--p 00015000 fd:00 175247426 /lib64/libnsl-2.12.so
7fbae4af7000-7fbae4af8000 rw-p 00016000 fd:00 175247426 /lib64/libnsl-2.12.so
7fbae4af8000-7fbae4afa000 rw-p 00000000 00:00 0
7fbae4afa000-7fbae4afc000 r-xp 00000000 fd:00 175247597 /lib64/libdl-2.12.so
7fbae4afc000-7fbae4cfc000 ---p 00002000 fd:00 175247597 /lib64/libdl-2.12.so
7fbae4cfc000-7fbae4cfd000 r--p 00002000 fd:00 175247597 /lib64/libdl-2.12.so
7fbae4cfd000-7fbae4cfe000 rw-p 00003000 fd:00 175247597 /lib64/libdl-2.12.so
7fbae4cfe000-7fbae4d81000 r-xp 00000000 fd:00 175247696 /lib64/libm-2.12.so
7fbae4d81000-7fbae4f80000 ---p 00083000 fd:00 175247696 /lib64/libm-2.12.so
7fbae4f80000-7fbae4f81000 r--p 00082000 fd:00 175247696 /lib64/libm-2.12.so
7fbae4f81000-7fbae4f82000 rw-p 00083000 fd:00 175247696 /lib64/libm-2.12.so
7fbae4f82000-7fbae4f92000 r-xp 00000000 fd:00 175247491 /lib64/libbz2.so.1.0.4
7fbae4f92000-7fbae5191000 ---p 00010000 fd:00 175247491 /lib64/libbz2.so.1.0.4
7fbae5191000-7fbae5193000 rw-p 0000f000 fd:00 175247491 /lib64/libbz2.so.1.0.4
7fbae5193000-7fbae51e5000 r-xp 00000000 fd:00 175250619 /usr/lib64/libcurl.so.4.1.1
7fbae51e5000-7fbae53e5000 ---p 00052000 fd:00 175250619 /usr/lib64/libcurl.so.4.1.1
7fbae53e5000-7fbae53e8000 rw-p 00052000 fd:00 175250619 /usr/lib64/libcurl.so.4.1.1
7fbae53e8000-7fbae5427000 r-xp 00000000 fd:00 175250198 /usr/lib64/libjpeg.so.62.0.0
7fbae5427000-7fbae5627000 ---p 0003f000 fd:00 175250198 /usr/lib64/libjpeg.so.62.0.0
7fbae5627000-7fbae5628000 rw-p 0003f000 fd:00 175250198 /usr/lib64/libjpeg.so.62.0.0
7fbae5628000-7fbae5638000 rw-p 00000000 00:00 0
7fbae5638000-7fbae565d000 r-xp 00000000 fd:00 175249518 /usr/lib64/libpng12.so.0.49.0
7fbae565d000-7fbae585d000 ---p 00025000 fd:00 175249518 /usr/lib64/libpng12.so.0.49.0
7fbae585d000-7fbae585e000 rw-p 00025000 fd:00 175249518 /usr/lib64/libpng12.so.0.49.0
7fbae585e000-7fbae5888000 r-xp 00000000 fd:00 175252370 /usr/lib64/libmcrypt.so.4.4.8
7fbae5888000-7fbae5a88000 ---p 0002a000 fd:00 175252370 /usr/lib64/libmcrypt.so.4.4.8
7fbae5a88000-7fbae5a8b000 rw-p 0002a000 fd:00 175252370 /usr/lib64/libmcrypt.so.4.4.8
7fbae5a8b000-7fbae5a91000 rw-p 00000000 00:00 0
7fbae5a91000-7fbae5a98000 r-xp 00000000 fd:00 175247702 /lib64/librt-2.12.so
7fbae5a98000-7fbae5c97000 ---p 00007000 fd:00 175247702 /lib64/librt-2.12.so
7fbae5c97000-7fbae5c98000 r--p 00006000 fd:00 175247702 /lib64/librt-2.12.so
7fbae5c98000-7fbae5c99000 rw-p 00007000 fd:00 175247702 /lib64/librt-2.12.so
7fbae5c99000-7fbae5cac000 r-xp 00000000 fd:00 175252301 /usr/lib64/libexslt.so.0.8.15
7fbae5cac000-7fbae5eac000 ---p 00013000 fd:00 175252301 /usr/lib64/libexslt.so.0.8.15
7fbae5eac000-7fbae5ead000 rw-p 00013000 fd:00 175252301 /usr/lib64/libexslt.so.0.8.15
7fbae5ead000-7fbae5ec2000 r-xp 00000000 fd:00 175247716 /lib64/libz.so.1.2.3
7fbae5ec2000-7fbae60c1000 ---p 00015000 fd:00 175247716 /lib64/libz.so.1.2.3
7fbae60c1000-7fbae60c2000 r--p 00014000 fd:00 175247716 /lib64/libz.so.1.2.3
7fbae60c2000-7fbae60c3000 rw-p 00015000 fd:00 175247716 /lib64/libz.so.1.2.3
7fbae60c3000-7fbae60ca000 r-xp 00000000 fd:00 175247467 /lib64/libcrypt-2.12.so
7fbae60ca000-7fbae62ca000 ---p 00007000 fd:00 175247467 /lib64/libcrypt-2.12.so
7fbae62ca000-7fbae62cb000 r--p 00007000 fd:00 175247467 /lib64/libcrypt-2.12.so
7fbae62cb000-7fbae62cc000 rw-p 00008000 fd:00 175247467 /lib64/libcrypt-2.12.so
7fbae62cc000-7fbae62fa000 rw-p 00000000 00:00 0
7fbae62fa000-7fbae631a000 r-xp 00000000 fd:00 175246506 /lib64/ld-2.12.so
7fbae6323000-7fbae6364000 rw-p 00000000 00:00 0
7fbae6367000-7fbae650d000 rw-p 00000000 00:00 0
7fbae6518000-7fbae6519000 rw-p 00000000 00:00 0
7fbae6519000-7fbae651a000 r--p 0001f000 fd:00 175246506 /lib64/ld-2.12.so
7fbae651a000-7fbae651b000 rw-p 00020000 fd:00 175246506 /lib64/ld-2.12.so
7fbae651b000-7fbae651c000 rw-p 00000000 00:00 0
7fff0e5a7000-7fff0e5bc000 rw-p 00000000 00:00 0 [stack]
7fff0e5f7000-7fff0e5f9000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

Riccardo90 · « **Reply #3 on:** March 11, 2016, 09:11:27 PM »

UP!... please help me to understand if this is an hacker attack or not!

Sandeep · « **Reply #4 on:** March 12, 2016, 03:37:42 AM »

its a false positive don't need to worry

crmgddn63 · « **Reply #5 on:** March 30, 2016, 09:21:26 AM »

hello an i give this message. i dont know where to open in forum this message. sorry.

Time: Wed Mar 30 11:28:17 2016 +0300
PID: 26747 (Parent PID:25546)
Account: nobody
Uptime: 870 seconds

Executable:

/usr/bin/python

Command Line (often faked in exploits):

/usr/bin/python /usr/libexec/postfix/policyd-spf

Network connections by the process (if any):

udp: 185.128.115.211:23127 -> 8.8.4.4:53

Files open by the process (if any):

Memory maps by the process (if any):

00400000-00401000 r-xp 00000000 08:01 16123602 /usr/bin/python
00600000-00601000 rw-p 00000000 08:01 16123602 /usr/bin/python
01019000-01345000 rw-p 00000000 00:00 0 [heap]
7f5db2509000-7f5db2511000 r-xp 00000000 08:01 16516332 /usr/lib64/python2.6/lib-dynload/arraymodule.so
7f5db2511000-7f5db2710000 ---p 00008000 08:01 16516332 /usr/lib64/python2.6/lib-dynload/arraymodule.so
7f5db2710000-7f5db2713000 rw-p 00007000 08:01 16516332 /usr/lib64/python2.6/lib-dynload/arraymodule.so
7f5db2713000-7f5db2793000 r-xp 00000000 08:01 16516365 /usr/lib64/python2.6/lib-dynload/unicodedata.so
7f5db2793000-7f5db2992000 ---p 00080000 08:01 16516365 /usr/lib64/python2.6/lib-dynload/unicodedata.so
7f5db2992000-7f5db29a3000 rw-p 0007f000 08:01 16516365 /usr/lib64/python2.6/lib-dynload/unicodedata.so
7f5db29a3000-7f5db29a5000 r-xp 00000000 08:01 16516342 /usr/lib64/python2.6/lib-dynload/fcntlmodule.so
7f5db29a5000-7f5db2ba5000 ---p 00002000 08:01 16516342 /usr/lib64/python2.6/lib-dynload/fcntlmodule.so
7f5db2ba5000-7f5db2ba7000 rw-p 00002000 08:01 16516342 /usr/lib64/python2.6/lib-dynload/fcntlmodule.so
7f5db2ba7000-7f5db2bab000 r-xp 00000000 08:01 16516358 /usr/lib64/python2.6/lib-dynload/selectmodule.so
7f5db2bab000-7f5db2dab000 ---p 00004000 08:01 16516358 /usr/lib64/python2.6/lib-dynload/selectmodule.so
7f5db2dab000-7f5db2dad000 rw-p 00004000 08:01 16516358 /usr/lib64/python2.6/lib-dynload/selectmodule.so
7f5db2dad000-7f5db2db0000 r-xp 00000000 08:01 16516326 /usr/lib64/python2.6/lib-dynload/_randommodule.so
7f5db2db0000-7f5db2faf000 ---p 00003000 08:01 16516326 /usr/lib64/python2.6/lib-dynload/_randommodule.so
7f5db2faf000-7f5db2fb0000 rw-p 00002000 08:01 16516326 /usr/lib64/python2.6/lib-dynload/_randommodule.so
7f5db2fb0000-7f5db2fb5000 r-xp 00000000 08:01 16516349 /usr/lib64/python2.6/lib-dynload/mathmodule.so
7f5db2fb5000-7f5db31b4000 ---p 00005000 08:01 16516349 /usr/lib64/python2.6/lib-dynload/mathmodule.so
7f5db31b4000-7f5db31b6000 rw-p 00004000 08:01 16516349 /usr/lib64/python2.6/lib-dynload/mathmodule.so
7f5db31b6000-7f5db31b8000 r-xp 00000000 08:01 16516317 /usr/lib64/python2.6/lib-dynload/_functoolsmodule.so
7f5db31b8000-7f5db33b8000 ---p 00002000 08:01 16516317 /usr/lib64/python2.6/lib-dynload/_functoolsmodule.so
7f5db33b8000-7f5db33b9000 rw-p 00002000 08:01 16516317 /usr/lib64/python2.6/lib-dynload/_functoolsmodule.so
7f5db33b9000-7f5db33bd000 r-xp 00000000 08:01 16516334 /usr/lib64/python2.6/lib-dynload/binascii.so
7f5db33bd000-7f5db35bd000 ---p 00004000 08:01 16516334 /usr/lib64/python2.6/lib-dynload/binascii.so
7f5db35bd000-7f5db35be000 rw-p 00004000 08:01 16516334 /usr/lib64/python2.6/lib-dynload/binascii.so
7f5db35be000-7f5db35c7000 r-xp 00000000 08:01 16516347 /usr/lib64/python2.6/lib-dynload/itertoolsmodule.so
7f5db35c7000-7f5db37c7000 ---p 00009000 08:01 16516347 /usr/lib64/python2.6/lib-dynload/itertoolsmodule.so
7f5db37c7000-7f5db37cb000 rw-p 00009000 08:01 16516347 /usr/lib64/python2.6/lib-dynload/itertoolsmodule.so
7f5db37cb000-7f5db37d3000 r-xp 00000000 08:01 16516352 /usr/lib64/python2.6/lib-dynload/operator.so
7f5db37d3000-7f5db39d2000 ---p 00008000 08:01 16516352 /usr/lib64/python2.6/lib-dynload/operator.so
7f5db39d2000-7f5db39d4000 rw-p 00007000 08:01 16516352 /usr/lib64/python2.6/lib-dynload/operator.so
7f5db39d4000-7f5db39da000 r-xp 00000000 08:01 16516309 /usr/lib64/python2.6/lib-dynload/_collectionsmodule.so
7f5db39da000-7f5db3bd9000 ---p 00006000 08:01 16516309 /usr/lib64/python2.6/lib-dynload/_collectionsmodule.so
7f5db3bd9000-7f5db3bdb000 rw-p 00005000 08:01 16516309 /usr/lib64/python2.6/lib-dynload/_collectionsmodule.so
7f5db3bdb000-7f5db3be0000 r-xp 00000000 08:01 16516360 /usr/lib64/python2.6/lib-dynload/stropmodule.so
7f5db3be0000-7f5db3ddf000 ---p 00005000 08:01 16516360 /usr/lib64/python2.6/lib-dynload/stropmodule.so
7f5db3ddf000-7f5db3de1000 rw-p 00004000 08:01 16516360 /usr/lib64/python2.6/lib-dynload/stropmodule.so
7f5db3de1000-7f5db3de4000 r-xp 00000000 08:01 16516363 /usr/lib64/python2.6/lib-dynload/timemodule.so
7f5db3de4000-7f5db3fe4000 ---p 00003000 08:01 16516363 /usr/lib64/python2.6/lib-dynload/timemodule.so
7f5db3fe4000-7f5db3fe6000 rw-p 00003000 08:01 16516363 /usr/lib64/python2.6/lib-dynload/timemodule.so
7f5db3fe6000-7f5db3fed000 r-xp 00000000 08:01 16516330 /usr/lib64/python2.6/lib-dynload/_struct.so
7f5db3fed000-7f5db41ed000 ---p 00007000 08:01 16516330 /usr/lib64/python2.6/lib-dynload/_struct.so
7f5db41ed000-7f5db41ef000 rw-p 00007000 08:01 16516330 /usr/lib64/python2.6/lib-dynload/_struct.so
7f5db41ef000-7f5db41f3000 r-xp 00000000 08:01 16516337 /usr/lib64/python2.6/lib-dynload/cStringIO.so
7f5db41f3000-7f5db43f2000 ---p 00004000 08:01 16516337 /usr/lib64/python2.6/lib-dynload/cStringIO.so
7f5db43f2000-7f5db43f4000 rw-p 00003000 08:01 16516337 /usr/lib64/python2.6/lib-dynload/cStringIO.so
7f5db43f4000-7f5db4411000 r-xp 00000000 08:01 1048660 /lib64/libselinux.so.1
7f5db4411000-7f5db4610000 ---p 0001d000 08:01 1048660 /lib64/libselinux.so.1
7f5db4610000-7f5db4611000 r--p 0001c000 08:01 1048660 /lib64/libselinux.so.1
7f5db4611000-7f5db4612000 rw-p 0001d000 08:01 1048660 /lib64/libselinux.so.1
7f5db4612000-7f5db4613000 rw-p 00000000 00:00 0
7f5db4613000-7f5db4629000 r-xp 00000000 08:01 1048617 /lib64/libresolv-2.12.so
7f5db4629000-7f5db4829000 ---p 00016000 08:01 1048617 /lib64/libresolv-2.12.so
7f5db4829000-7f5db482a000 r--p 00016000 08:01 1048617 /lib64/libresolv-2.12.so
7f5db482a000-7f5db482b000 rw-p 00017000 08:01 1048617 /lib64/libresolv-2.12.so
7f5db482b000-7f5db482d000 rw-p 00000000 00:00 0
7f5db482d000-7f5db482f000 r-xp 00000000 08:01 1048760 /lib64/libkeyutils.so.1.3
7f5db482f000-7f5db4a2e000 ---p 00002000 08:01 1048760 /lib64/libkeyutils.so.1.3
7f5db4a2e000-7f5db4a2f000 r--p 00001000 08:01 1048760 /lib64/libkeyutils.so.1.3
7f5db4a2f000-7f5db4a30000 rw-p 00002000 08:01 1048760 /lib64/libkeyutils.so.1.3
7f5db4a30000-7f5db4a3a000 r-xp 00000000 08:01 1048653 /lib64/libkrb5support.so.0.1
7f5db4a3a000-7f5db4c39000 ---p 0000a000 08:01 1048653 /lib64/libkrb5support.so.0.1
7f5db4c39000-7f5db4c3a000 r--p 00009000 08:01 1048653 /lib64/libkrb5support.so.0.1
7f5db4c3a000-7f5db4c3b000 rw-p 0000a000 08:01 1048653 /lib64/libkrb5support.so.0.1
7f5db4c3b000-7f5db4c50000 r-xp 00000000 08:01 1048642 /lib64/libz.so.1.2.3
7f5db4c50000-7f5db4e4f000 ---p 00015000 08:01 1048642 /lib64/libz.so.1.2.3
7f5db4e4f000-7f5db4e50000 r--p 00014000 08:01 1048642 /lib64/libz.so.1.2.3
7f5db4e50000-7f5db4e51000 rw-p 00015000 08:01 1048642 /lib64/libz.so.1.2.3
7f5db4e51000-7f5db4e7a000 r-xp 00000000 08:01 1048616 /lib64/libk5crypto.so.3.1
7f5db4e7a000-7f5db507a000 ---p 00029000 08:01 1048616 /lib64/libk5crypto.so.3.1
7f5db507a000-7f5db507b000 r--p 00029000 08:01 1048616 /lib64/libk5crypto.so.3.1
7f5db507b000-7f5db507c000 rw-p 0002a000 08:01 1048616 /lib64/libk5crypto.so.3.1
7f5db507c000-7f5db507d000 rw-p 00000000 00:00 0
7f5db507d000-7f5db5080000 r-xp 00000000 08:01 1048652 /lib64/libcom_err.so.2.1
7f5db5080000-7f5db527f000 ---p 00003000 08:01 1048652 /lib64/libcom_err.so.2.1
7f5db527f000-7f5db5280000 r--p 00002000 08:01 1048652 /lib64/libcom_err.so.2.1
7f5db5280000-7f5db5281000 rw-p 00003000 08:01 1048652 /lib64/libcom_err.so.2.1
7f5db5281000-7f5db535c000 r-xp 00000000 08:01 1048620 /lib64/libkrb5.so.3.3
7f5db535c000-7f5db555c000 ---p 000db000 08:01 1048620 /lib64/libkrb5.so.3.3
7f5db555c000-7f5db5566000 r--p 000db000 08:01 1048620 /lib64/libkrb5.so.3.3
7f5db5566000-7f5db5568000 rw-p 000e5000 08:01 1048620 /lib64/libkrb5.so.3.3
7f5db5568000-7f5db55a9000 r-xp 00000000 08:01 1048600 /lib64/libgssapi_krb5.so.2.2
7f5db55a9000-7f5db57a9000 ---p 00041000 08:01 1048600 /lib64/libgssapi_krb5.so.2.2
7f5db57a9000-7f5db57aa000 r--p 00041000 08:01 1048600 /lib64/libgssapi_krb5.so.2.2
7f5db57aa000-7f5db57ac000 rw-p 00042000 08:01 1048600 /lib64/libgssapi_krb5.so.2.2
7f5db57ac000-7f5db5966000 r-xp 00000000 08:01 16123419 /usr/lib64/libcrypto.so.1.0.1e
7f5db5966000-7f5db5b65000 ---p 001ba000 08:01 16123419 /usr/lib64/libcrypto.so.1.0.1e
7f5db5b65000-7f5db5b80000 r--p 001b9000 08:01 16123419 /usr/lib64/libcrypto.so.1.0.1e
7f5db5b80000-7f5db5b8c000 rw-p 001d4000 08:01 16123419 /usr/lib64/libcrypto.so.1.0.1e
7f5db5b8c000-7f5db5b90000 rw-p 00000000 00:00 0
7f5db5b90000-7f5db5bf2000 r-xp 00000000 08:01 16124207 /usr/lib64/libssl.so.1.0.1e
7f5db5bf2000-7f5db5df1000 ---p 00062000 08:01 16124207 /usr/lib64/libssl.so.1.0.1e
7f5db5df1000-7f5db5df5000 r--p 00061000 08:01 16124207 /usr/lib64/libssl.so.1.0.1e
7f5db5df5000-7f5db5dfc000 rw-p 00065000 08:01 16124207 /usr/lib64/libssl.so.1.0.1e
7f5db5dfc000-7f5db5e03000 r-xp 00000000 08:01 16516329 /usr/lib64/python2.6/lib-dynload/_ssl.so
7f5db5e03000-7f5db6002000 ---p 00007000 08:01 16516329 /usr/lib64/python2.6/lib-dynload/_ssl.so
7f5db6002000-7f5db6004000 rw-p 00006000 08:01 16516329 /usr/lib64/python2.6/lib-dynload/_ssl.so
7f5db6004000-7f5db600f000 r-xp 00000000 08:01 16516327 /usr/lib64/python2.6/lib-dynload/_socketmodule.so
7f5db600f000-7f5db620f000 ---p 0000b000 08:01 16516327 /usr/lib64/python2.6/lib-dynload/_socketmodule.so
7f5db620f000-7f5db6213000 rw-p 0000b000 08:01 16516327 /usr/lib64/python2.6/lib-dynload/_socketmodule.so
7f5db6213000-7f5db6215000 r-xp 00000000 08:01 16516361 /usr/lib64/python2.6/lib-dynload/syslog.so
7f5db6215000-7f5db6414000 ---p 00002000 08:01 16516361 /usr/lib64/python2.6/lib-dynload/syslog.so
7f5db6414000-7f5db6415000 rw-p 00001000 08:01 16516361 /usr/lib64/python2.6/lib-dynload/syslog.so
7f5db6415000-7f5db6456000 rw-p 00000000 00:00 0
7f5db6497000-7f5db64d8000 rw-p 00000000 00:00 0
7f5db64d8000-7f5db64e4000 r-xp 00000000 08:01 1048607 /lib64/libnss_files-2.12.so
7f5db64e4000-7f5db66e4000 ---p 0000c000 08:01 1048607 /lib64/libnss_files-2.12.so
7f5db66e4000-7f5db66e5000 r--p 0000c000 08:01 1048607 /lib64/libnss_files-2.12.so
7f5db66e5000-7f5db66e6000 rw-p 0000d000 08:01 1048607 /lib64/libnss_files-2.12.so
7f5db66e6000-7f5db6870000 r-xp 00000000 08:01 1048591 /lib64/libc-2.12.so
7f5db6870000-7f5db6a70000 ---p 0018a000 08:01 1048591 /lib64/libc-2.12.so
7f5db6a70000-7f5db6a74000 r--p 0018a000 08:01 1048591 /lib64/libc-2.12.so
7f5db6a74000-7f5db6a75000 rw-p 0018e000 08:01 1048591 /lib64/libc-2.12.so
7f5db6a75000-7f5db6a7a000 rw-p 00000000 00:00 0
7f5db6a7a000-7f5db6afd000 r-xp 00000000 08:01 1048599 /lib64/libm-2.12.so
7f5db6afd000-7f5db6cfc000 ---p 00083000 08:01 1048599 /lib64/libm-2.12.so
7f5db6cfc000-7f5db6cfd000 r--p 00082000 08:01 1048599 /lib64/libm-2.12.so
7f5db6cfd000-7f5db6cfe000 rw-p 00083000 08:01 1048599 /lib64/libm-2.12.so
7f5db6cfe000-7f5db6d00000 r-xp 00000000 08:01 1048623 /lib64/libutil-2.12.so
7f5db6d00000-7f5db6eff000 ---p 00002000 08:01 1048623 /lib64/libutil-2.12.so
7f5db6eff000-7f5db6f00000 r--p 00001000 08:01 1048623 /lib64/libutil-2.12.so
7f5db6f00000-7f5db6f01000 rw-p 00002000 08:01 1048623 /lib64/libutil-2.12.so
7f5db6f01000-7f5db6f03000 r-xp 00000000 08:01 1048597 /lib64/libdl-2.12.so
7f5db6f03000-7f5db7103000 ---p 00002000 08:01 1048597 /lib64/libdl-2.12.so
7f5db7103000-7f5db7104000 r--p 00002000 08:01 1048597 /lib64/libdl-2.12.so
7f5db7104000-7f5db7105000 rw-p 00003000 08:01 1048597 /lib64/libdl-2.12.so
7f5db7105000-7f5db711c000 r-xp 00000000 08:01 1048615 /lib64/libpthread-2.12.so
7f5db711c000-7f5db731c000 ---p 00017000 08:01 1048615 /lib64/libpthread-2.12.so
7f5db731c000-7f5db731d000 r--p 00017000 08:01 1048615 /lib64/libpthread-2.12.so
7f5db731d000-7f5db731e000 rw-p 00018000 08:01 1048615 /lib64/libpthread-2.12.so
7f5db731e000-7f5db7322000 rw-p 00000000 00:00 0
7f5db7322000-7f5db747f000 r-xp 00000000 08:01 16123603 /usr/lib64/libpython2.6.so.1.0
7f5db747f000-7f5db767e000 ---p 0015d000 08:01 16123603 /usr/lib64/libpython2.6.so.1.0
7f5db767e000-7f5db76ba000 rw-p 0015c000 08:01 16123603 /usr/lib64/libpython2.6.so.1.0
7f5db76ba000-7f5db76c8000 rw-p 00000000 00:00 0
7f5db76c8000-7f5db76e8000 r-xp 00000000 08:01 1048938 /lib64/ld-2.12.so
7f5db77a2000-7f5db7856000 rw-p 00000000 00:00 0
7f5db7857000-7f5db78de000 rw-p 00000000 00:00 0
7f5db78e5000-7f5db78e7000 rw-p 00000000 00:00 0
7f5db78e7000-7f5db78e8000 r--p 0001f000 08:01 1048938 /lib64/ld-2.12.so
7f5db78e8000-7f5db78e9000 rw-p 00020000 08:01 1048938 /lib64/ld-2.12.so
7f5db78e9000-7f5db78ea000 rw-p 00000000 00:00 0
7fff38512000-7fff38530000 rw-p 00000000 00:00 0 [stack]
7fff385fa000-7fff385fb000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

thank you

Administrator · « **Reply #6 on:** March 30, 2016, 01:19:51 PM »

you should always check and investigate this suspicious notifications, if this remote connections are done from php then you should check files/account which is connecting to the other server and why.

Sometimes that is difficult but you will need to check last file modification ....

Control Web Panel

Author Topic: Suspicious process running under user %username% (Read 15180 times)

Suspicious process running under user %username%

Re: Suspicious process running under user %username%

Re: Suspicious process running under user %username%

Re: Suspicious process running under user %username%

Re: Suspicious process running under user %username%

Re: Suspicious process running under user %username%

Re: Suspicious process running under user %username%