Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Cp-Wrap Push/Add - what is this doing?

Discussion in 'Security' started by thinkshovels, Nov 23, 2012.

  1. thinkshovels

    thinkshovels Registered

    Nov 15, 2012
    Likes Received:
    Trophy Points:
    cPanel Access Level:
    Root Administrator
    Hi, I am seeing lines like this pop up in secure log:

    secure-20121118:Nov 14 14:59:44 server Cp-Wrap[18556]: Pushing "553 DEL paypal-verfication" to '/usr/local/cpanel/bin/domainadmin' for UID: 553
    secure-20121118:Nov 14 15:08:36 server Cp-Wrap[25135]: Pushing "553 ADD XXXXXXXXXXXXXXXXXX 1 /home/domain1/public_html/" to '/usr/local/cpanel/bin/domainadmin' for UID: 553

    We are consistently having these paypal fishing folders pop up on multiple accounts on this server and this is the only reference I find to them in any log and I'm really not sure how they are being created. Are these log files providing a hint? At first glance it seems like they are but I can't seem to find much on what cp-wrap does on the web.


Share This Page