SOLVED Just got email from csf that httpd got deleted ?

Spirogg

Well-Known Member
Feb 21, 2018
695
151
43
chicago
cPanel Access Level
Root Administrator
Time: Wed Apr 20 17:59:07 2022 -0500
PID: 2381 (Parent PID:2371)
Account: nobody
Uptime: 3133 seconds


Executable:

/usr/sbin/httpd (deleted)

The file system shows this process is running an executable file that has been deleted. This typically happens when the original file has been replaced by a new file when the application is updated. To prevent this being reported again, restart the process that runs this excecutable file. See csf.conf and the PT_DELETED text for more information about the security implications of processes running deleted executable files.


Command Line (often faked in exploits):

/usr/sbin/httpd -k start


I could not use my iPhone to copy and past the message because of the cookies issue in this forum

so that is why I did this in 2 parts.
 
Last edited:

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
10,360
1,628
363
cPanel Access Level
Root Administrator
Hey hey! That sounds right - there was an update last night and I got this from CSF on my box:

Code:
The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/bin/ab: FAILED
/usr/bin/ea-php73: FAILED
/usr/bin/ea-php74: FAILED
/usr/bin/ea-php80: FAILED
/usr/bin/ea-php81: FAILED
/usr/bin/htdbm: FAILED
/usr/bin/htdigest: FAILED
/usr/bin/htpasswd: FAILED
/usr/bin/httxt2dbm: FAILED
/usr/bin/logresolve: FAILED
/usr/sbin/fcgistarter: FAILED
/usr/sbin/htcacheclean: FAILED
/usr/sbin/httpd: FAILED
/usr/sbin/nginx: FAILED
/usr/sbin/nginx-debug: FAILED
/usr/sbin/rotatelogs: FAILED
/usr/sbin/suexec: FAILED
/bin/ab: FAILED
/bin/ea-php73: FAILED
/bin/ea-php74: FAILED
/bin/ea-php80: FAILED
/bin/ea-php81: FAILED
/bin/htdbm: FAILED
/bin/htdigest: FAILED
/bin/htpasswd: FAILED
/bin/httxt2dbm: FAILED
/bin/logresolve: FAILED
/sbin/fcgistarter: FAILED
/sbin/htcacheclean: FAILED
/sbin/httpd: FAILED
/sbin/nginx: FAILED
/sbin/nginx-debug: FAILED
/sbin/rotatelogs: FAILED
/sbin/suexec: FAILED
/usr/local/bin/ea-php73: FAILED
/usr/local/bin/ea-php74: FAILED
/usr/local/bin/ea-php80: FAILED
/usr/local/bin/ea-php81: FAILED
 
  • Like
Reactions: Spirogg

Spirogg

Well-Known Member
Feb 21, 2018
695
151
43
chicago
cPanel Access Level
Root Administrator
Hey hey! That sounds right - there was an update last night and I got this from CSF on my box:

Code:
The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/bin/ab: FAILED
/usr/bin/ea-php73: FAILED
/usr/bin/ea-php74: FAILED
/usr/bin/ea-php80: FAILED
/usr/bin/ea-php81: FAILED
/usr/bin/htdbm: FAILED
/usr/bin/htdigest: FAILED
/usr/bin/htpasswd: FAILED
/usr/bin/httxt2dbm: FAILED
/usr/bin/logresolve: FAILED
/usr/sbin/fcgistarter: FAILED
/usr/sbin/htcacheclean: FAILED
/usr/sbin/httpd: FAILED
/usr/sbin/nginx: FAILED
/usr/sbin/nginx-debug: FAILED
/usr/sbin/rotatelogs: FAILED
/usr/sbin/suexec: FAILED
/bin/ab: FAILED
/bin/ea-php73: FAILED
/bin/ea-php74: FAILED
/bin/ea-php80: FAILED
/bin/ea-php81: FAILED
/bin/htdbm: FAILED
/bin/htdigest: FAILED
/bin/htpasswd: FAILED
/bin/httxt2dbm: FAILED
/bin/logresolve: FAILED
/sbin/fcgistarter: FAILED
/sbin/htcacheclean: FAILED
/sbin/httpd: FAILED
/sbin/nginx: FAILED
/sbin/nginx-debug: FAILED
/sbin/rotatelogs: FAILED
/sbin/suexec: FAILED
/usr/local/bin/ea-php73: FAILED
/usr/local/bin/ea-php74: FAILED
/usr/local/bin/ea-php80: FAILED
/usr/local/bin/ea-php81: FAILED
Ok thanks this is solved. Was just making sure :)
 
  • Like
Reactions: cPRex