SOLVED list of updated files includes eggdrop.sym, ircd.sym and other suspicious files

[jeffschips]

Hello.

I normally receive updates on files not matching md5sums and check if it was the result of an update. But today I received a list of updated files the likes of the following:

[2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/BitchX.sym ..Done
[2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/bnc.sym ..Done
[2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/eggdrop.sym ..Done
[2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/generic-sniffers.sym ..Done
[2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/guardservices.sym ..Done
[2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/ircd.sym ..Done
[2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/psyBNC.sym ..Done
[2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/ptlink.sym ..Done
[2021-11-01 22:39:31 -0400] [/usr/local/cpanel/bin/dcpumon] Loading Symbol Table... /usr/local/cpanel/etc/sym/services.sym ..Done

What the heck is this stuff? bitchX.sym, generic-sniffers.sym? When attemtping to contact and log a report with cpanel can't get into the client portal.

 

[quietFinn]

I believe those have something to do with "Backgroud Process Killer", WHM -> System Health -> Backgroud Process Killer

 

[cPanelAnthony]

Hello! While you would ultimately want to confirm that these files are legitimate with a systems administrator, "BitchX" is actually legitimate software; it appears to be an IRC.

cPanel you intrigue me...

So I got into work this morning and was checking some of the logs on one of my web servers and found this buried in there...[2017... | Water Cooler

community.spiceworks.com

I am not sure what "generic-sniffers" is, however.

 

[quietFinn]

More info here:

Background Process Killer | cPanel & WHM Documentation

This interface allows you to select processes that the system will terminate when the upcp script calls the system maintenance script every night.

docs.cpanel.net

 

[jeffschips]

SOLVED: those files with ominous-sounding names are in fact symbolic links to services that monitor *for* those miscreant services. They are *not* the services themselves.

 

[cPanelAnthony]

Thank you for this confirmatiton! It is good information to have.