The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

lot of httpsl process

Discussion in 'General Discussion' started by Anishts, Jul 11, 2006.

  1. Anishts

    Anishts Active Member

    Joined:
    Oct 6, 2005
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    6
    Hi,

    ps aux gives lot of httpsl process.

    xxxx 20121 0.0 0.1 4344 2376 ? S Jul10 0:00 httpsl
    xxxx 20140 0.0 0.1 4344 2572 ? S Jul10 0:00 httpsl
    xxxx 20859 0.0 0.1 4336 2240 ? S Jul10 0:00 httpsl
    xxxx 20891 0.0 0.1 4336 2240 ? S Jul10 0:00 httpsl

    anybody knows what is this process and why it is coming ?
     
  2. katmai

    katmai Well-Known Member

    Joined:
    Mar 13, 2006
    Messages:
    526
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Brno, Czech Republic


    you just got hacked :)
     
  3. avijit

    avijit Well-Known Member

    Joined:
    Jul 26, 2004
    Messages:
    116
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    India
    check the working directory of the pids of those running processes.

    ls -l /proc/<pid-of-the-process-that-you-got-from-top>

    It will give you the cwd( current working directory ) of the processes. Then investigate further.
     
  4. Anishts

    Anishts Active Member

    Joined:
    Oct 6, 2005
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    6
    Hi

    I think it is hacked, since lot of connections from one ip and all are using this process. When I checked in cwd in proc its showing cwd as / only. Any way killed all that process and blocked that ip :) . Asked one client to upgrade his php nuke. After that this httpsl process not came back.
     
Loading...

Share This Page