Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

lot of httpsl process

Discussion in 'General Discussion' started by Anishts, Jul 11, 2006.

  1. Anishts

    Anishts Active Member

    Joined:
    Oct 6, 2005
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    156
    Hi,

    ps aux gives lot of httpsl process.

    xxxx 20121 0.0 0.1 4344 2376 ? S Jul10 0:00 httpsl
    xxxx 20140 0.0 0.1 4344 2572 ? S Jul10 0:00 httpsl
    xxxx 20859 0.0 0.1 4336 2240 ? S Jul10 0:00 httpsl
    xxxx 20891 0.0 0.1 4336 2240 ? S Jul10 0:00 httpsl

    anybody knows what is this process and why it is coming ?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. katmai

    katmai Well-Known Member

    Joined:
    Mar 13, 2006
    Messages:
    533
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Brno, Czech Republic


    you just got hacked :)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. avijit

    avijit Well-Known Member

    Joined:
    Jul 26, 2004
    Messages:
    116
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    India
    check the working directory of the pids of those running processes.

    ls -l /proc/<pid-of-the-process-that-you-got-from-top>

    It will give you the cwd( current working directory ) of the processes. Then investigate further.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. Anishts

    Anishts Active Member

    Joined:
    Oct 6, 2005
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    156
    Hi

    I think it is hacked, since lot of connections from one ip and all are using this process. When I checked in cwd in proc its showing cwd as / only. Any way killed all that process and blocked that ip :) . Asked one client to upgrade his php nuke. After that this httpsl process not came back.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice