The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

lfd on xxx.xxx: Suspicious process running under user dbus

Discussion in 'General Discussion' started by tui, May 28, 2015.

  1. tui

    tui Active Member

    Joined:
    Jun 15, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Mexico
    cPanel Access Level:
    Root Administrator
    Hello, all i know that LFD alerts are not from cPanel/Whm however i want to ask first here because this new (and strange) alert was caused after i run easyapache; I run easyapache in one of my servers and after it finished this LFD alert comes every hour:

    Code:
    Time:    Thu May 28 00:00:03 2015 -0500
    PID:     2025 (Parent PID:2025)
    Account: dbus
    Uptime:  13438445 seconds
    
    
    Executable:
    
    (deleted)/bin/dbus-daemon
    
    The file system shows this process is running an executable file that has been deleted. This typically happens when the original file has been replaced by a new file when the application is updated. To prevent this being reported again, restart the process that runs this excecutable file. See csf.conf and the PT_DELETED text for more information about the security implications of processes running deleted executable files.
    
    
    Command Line (often faked in exploits):
    
    dbus-daemon --system
    
    
    Network connections by the process (if any):
    
    
    
    Files open by the process (if any):
    
    /dev/null
    /dev/null
    /dev/null
    /dev/null
    inotify
    
    
    Memory maps by the process (if any):
    
    7fbb3cbf4000-7fbb3cc00000 r-xp 00000000 fd:00 2229411                     (deleted)/lib64/libnss_files-2.12.so
    7fbb3cc00000-7fbb3ce00000 ---p 0000c000 fd:00 2229411                     (deleted)/lib64/libnss_files-2.12.so
    7fbb3ce00000-7fbb3ce01000 r--p 0000c000 fd:00 2229411                     (deleted)/lib64/libnss_files-2.12.so
    7fbb3ce01000-7fbb3ce02000 rw-p 0000d000 fd:00 2229411                     (deleted)/lib64/libnss_files-2.12.so
    7fbb3ce02000-7fbb3ce04000 r-xp 00000000 fd:00 2229403                     (deleted)/lib64/libdl-2.12.so
    7fbb3ce04000-7fbb3d004000 ---p 00002000 fd:00 2229403                     (deleted)/lib64/libdl-2.12.so
    7fbb3d004000-7fbb3d005000 r--p 00002000 fd:00 2229403                     (deleted)/lib64/libdl-2.12.so
    7fbb3d005000-7fbb3d006000 rw-p 00003000 fd:00 2229403                     (deleted)/lib64/libdl-2.12.so
    7fbb3d006000-7fbb3d190000 r-xp 00000000 fd:00 2228232                     (deleted)/lib64/libc-2.12.so
    7fbb3d190000-7fbb3d390000 ---p 0018a000 fd:00 2228232                     (deleted)/lib64/libc-2.12.so
    7fbb3d390000-7fbb3d394000 r--p 0018a000 fd:00 2228232                     (deleted)/lib64/libc-2.12.so
    7fbb3d394000-7fbb3d395000 rw-p 0018e000 fd:00 2228232                     (deleted)/lib64/libc-2.12.so
    7fbb3d395000-7fbb3d39a000 rw-p 00000000 00:00 0
    7fbb3d39a000-7fbb3d3a1000 r-xp 00000000 fd:00 2229445                     (deleted)/lib64/librt-2.12.so
    7fbb3d3a1000-7fbb3d5a0000 ---p 00007000 fd:00 2229445                     (deleted)/lib64/librt-2.12.so
    7fbb3d5a0000-7fbb3d5a1000 r--p 00006000 fd:00 2229445                     (deleted)/lib64/librt-2.12.so
    7fbb3d5a1000-7fbb3d5a2000 rw-p 00007000 fd:00 2229445                     (deleted)/lib64/librt-2.12.so
    7fbb3d5a2000-7fbb3d5b9000 r-xp 00000000 fd:00 2228256                     (deleted)/lib64/libpthread-2.12.so
    7fbb3d5b9000-7fbb3d7b9000 ---p 00017000 fd:00 2228256                     (deleted)/lib64/libpthread-2.12.so
    7fbb3d7b9000-7fbb3d7ba000 r--p 00017000 fd:00 2228256                     (deleted)/lib64/libpthread-2.12.so
    7fbb3d7ba000-7fbb3d7bb000 rw-p 00018000 fd:00 2228256                     (deleted)/lib64/libpthread-2.12.so
    7fbb3d7bb000-7fbb3d7bf000 rw-p 00000000 00:00 0
    7fbb3d7bf000-7fbb3d7c3000 r-xp 00000000 fd:00 2228334                    /lib64/libcap-ng.so.0.0.0
    7fbb3d7c3000-7fbb3d9c2000 ---p 00004000 fd:00 2228334                    /lib64/libcap-ng.so.0.0.0
    7fbb3d9c2000-7fbb3d9c3000 r--p 00003000 fd:00 2228334                    /lib64/libcap-ng.so.0.0.0
    7fbb3d9c3000-7fbb3d9c4000 rw-p 00004000 fd:00 2228334                    /lib64/libcap-ng.so.0.0.0
    7fbb3d9c4000-7fbb3d9db000 r-xp 00000000 fd:00 2229073                    /lib64/libaudit.so.1.0.0
    7fbb3d9db000-7fbb3dbdb000 ---p 00017000 fd:00 2229073                    /lib64/libaudit.so.1.0.0
    7fbb3dbdb000-7fbb3dbdc000 r--p 00017000 fd:00 2229073                    /lib64/libaudit.so.1.0.0
    7fbb3dbdc000-7fbb3dbe7000 rw-p 00018000 fd:00 2229073                    /lib64/libaudit.so.1.0.0
    7fbb3dbe7000-7fbb3dc04000 r-xp 00000000 fd:00 2229517                    /lib64/libselinux.so.1
    7fbb3dc04000-7fbb3de03000 ---p 0001d000 fd:00 2229517                    /lib64/libselinux.so.1
    7fbb3de03000-7fbb3de04000 r--p 0001c000 fd:00 2229517                    /lib64/libselinux.so.1
    7fbb3de04000-7fbb3de05000 rw-p 0001d000 fd:00 2229517                    /lib64/libselinux.so.1
    7fbb3de05000-7fbb3de06000 rw-p 00000000 00:00 0
    7fbb3de06000-7fbb3de2c000 r-xp 00000000 fd:00 2228320                    /lib64/libexpat.so.1.5.2
    7fbb3de2c000-7fbb3e02b000 ---p 00026000 fd:00 2228320                    /lib64/libexpat.so.1.5.2
    7fbb3e02b000-7fbb3e02e000 rw-p 00025000 fd:00 2228320                    /lib64/libexpat.so.1.5.2
    7fbb3e02e000-7fbb3e04e000 r-xp 00000000 fd:00 2228615                     (deleted)/lib64/ld-2.12.so
    7fbb3e23d000-7fbb3e242000 rw-p 00000000 00:00 0
    7fbb3e24c000-7fbb3e24d000 rw-p 00000000 00:00 0
    7fbb3e24d000-7fbb3e24e000 r--p 0001f000 fd:00 2228615                     (deleted)/lib64/ld-2.12.so
    7fbb3e24e000-7fbb3e24f000 rw-p 00020000 fd:00 2228615                     (deleted)/lib64/ld-2.12.so
    7fbb3e24f000-7fbb3e250000 rw-p 00000000 00:00 0
    7fbb3e250000-7fbb3e2a1000 r-xp 00000000 fd:00 393227                      (deleted)/bin/dbus-daemon
    7fbb3e4a1000-7fbb3e4a2000 r--p 00051000 fd:00 393227                      (deleted)/bin/dbus-daemon
    7fbb3e4a2000-7fbb3e4a3000 rw-p 00052000 fd:00 393227                      (deleted)/bin/dbus-daemon
    7fbb3ec42000-7fbb3ec63000 rw-p 00000000 00:00 0                          [heap]
    7fff104a0000-7fff104b5000 rw-p 00000000 00:00 0                          [stack]
    7fff10583000-7fff10585000 r-xp 00000000 00:00 0                          [vdso]
    ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
    However my pignore file is same on all servers and there are this lines (by default) on it:

    Code:
    exe:/bin/dbus-daemon
    exe:/usr/bin/dbus-daemon-1
    Where does this alerts comes? Why it comes if dbus-daemon is on pignore? Why after i ran easyapache?

    I have this version: CLOUDLINUX 6.6 x86_64 kvm – XXXXX WHM 11.48.4 (build 4)
     
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    14,447
    Likes Received:
    195
    Trophy Points:
    63
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    The answer is still found in your own settings, and on the CSF forums.

     
Loading...

Share This Page