The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Got Milk? Great, now what the $%^& is it?

Discussion in 'General Discussion' started by tc0, Dec 7, 2004.

  1. tc0

    tc0 Member

    Joined:
    Jul 20, 2003
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    1
    /bin:
    -rwxr-xr-x 1 root root 4180 Aug 8 2002 milk*

    Any idea what that is? I just caught 6500 messages in my queue (WHM 9.9.7 cPanel 9.9.8-S6 RedHat 8.0 i686 - WHM X v3.1.0) and decided to run top expecting exim to be burning up my celeron. Whoa now?!@$# WTF is milk ? There was about 50 (more but it scrolled off) instances of milk running. Any idea what this is and why it has no man page or documentation out there?
     
  2. linux-image

    linux-image Well-Known Member

    Joined:
    Jun 8, 2004
    Messages:
    1,192
    Likes Received:
    1
    Trophy Points:
    38
    Location:
    India
    cPanel Access Level:
    Root Administrator
    your server seems to be compromised. there is no binary as milk at /bin. please run a chkroot kit and verify the integrity of the binaries.
     
  3. tc0

    tc0 Member

    Joined:
    Jul 20, 2003
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    1
    Maybe

    Thats kinda what I was thinking. But the latest chkrootkit didn't see anything special. I am wondering if milk was apart of clamav or something. I had some pretty tweaked up av/spam filtering before it came so mainstream for cpanel. Although I haven't seen any ill effects since deleting that file.
     
  4. Roy@ENHOST

    Roy@ENHOST Well-Known Member

    Joined:
    Mar 5, 2002
    Messages:
    495
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Los Angeles California
    If you have 6500 email messages in queue, something is REALLY wrong. I hate to break it to you but chances is that your system was compromised.
     
  5. tc0

    tc0 Member

    Joined:
    Jul 20, 2003
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    1
    I know why I had 6500 messages in my queue... It had nothing to do with the milk thing.
     
  6. linux-image

    linux-image Well-Known Member

    Joined:
    Jun 8, 2004
    Messages:
    1,192
    Likes Received:
    1
    Trophy Points:
    38
    Location:
    India
    cPanel Access Level:
    Root Administrator
  7. DigiCrime

    DigiCrime Well-Known Member

    Joined:
    Nov 27, 2002
    Messages:
    399
    Likes Received:
    0
    Trophy Points:
    16
    Being that its owned by root Id get that system reloaded, any filed owned by root that wasnt placed there by the system or yourself... baaaad news
     
Loading...

Share This Page