Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Who is running this: /hsphere/shared/apache/bin/httpd -DSSL ?

Discussion in 'EasyApache' started by EdRooney, Dec 28, 2004.

  1. EdRooney

    EdRooney BANNED

    Joined:
    Oct 21, 2004
    Messages:
    166
    Likes Received:
    0
    Trophy Points:
    166
    Whois is running perl?

    # cat /proc/15118/cmdline
    /hsphere/shared/apache/bin/httpd -DSSL

    #cat /proc/15118/environ
    hared/apache/bin/httpd -DSSL

    What user is running this?
    /hsphere/shared/apache/bin/httpd -DSSL
     
  2. mike_r

    mike_r Well-Known Member

    Joined:
    Nov 26, 2002
    Messages:
    45
    Likes Received:
    0
    Trophy Points:
    156
  3. EdRooney

    EdRooney BANNED

    Joined:
    Oct 21, 2004
    Messages:
    166
    Likes Received:
    0
    Trophy Points:
    166
    Tried, it but it is sitll running:
    root 17116 0.0 0.1 33220 1392 ? S Dec28 0:02 /usr/local/apache/bin/httpd -DSSL
    nobody 17140 0.0 1.3 37976 14152 ? S Dec28 0:08 /usr/local/apache/bin/httpd -DSSL
    nobody 17144 0.0 1.3 38328 14228 ? S Dec28 0:14 /usr/local/apache/bin/httpd -DSSL
    nobody 17158 0.0 1.7 37112 18252 ? S Dec28 0:22 /usr/local/apache/bin/httpd -DSSL
    nobody 17175 0.0 1.3 40016 14040 ? S Dec28 0:12 /usr/local/apache/bin/httpd -DSSL
    nobody 14591 0.0 1.3 38652 14020 ? S 00:14 0:03 /usr/local/apache/bin/httpd -DSSL
    nobody 20877 0.0 0.1 4252 1456 ? S 00:37 0:00 /usr/local/sbin/httpd - spy
    nobody 24708 0.0 0.1 6584 1516 ? S 00:49 0:04 /usr/local/sbin/httpd - spy
    nobody 12702 0.0 0.1 6428 1516 ? S 01:55 0:03 /usr/local/sbin/httpd - spy
    nobody 17957 0.1 0.2 6816 3048 ? S 05:55 0:14 /usr/local/sbin/httpd - spy
    nobody 20533 0.1 0.2 6696 3048 ? S 06:06 0:14 /usr/local/sbin/httpd - spy
    nobody 32506 0.1 0.1 6456 1516 ? S 06:49 0:08 /usr/local/sbin/httpd - spy
    nobody 2807 0.1 0.4 6516 4280 ? S 06:59 0:08 /usr/local/sbin/httpd - spy
    nobody 20962 0.1 0.2 6340 2648 ? S 08:02 0:02 /usr/local/sbin/httpd - spy
    nobody 23018 0.1 0.2 4152 2552 ? S 08:07 0:01 /usr/local/sbin/httpd - spy
    nobody 23035 0.1 1.5 35652 15496 ? S 08:07 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 23077 0.1 1.4 36788 14432 ? S 08:07 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 23087 0.1 1.5 36520 15456 ? D 08:07 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 23088 0.1 1.4 34528 15076 ? S 08:07 0:00 /usr/local/apache/bin/httpd -DSSL
    nobody 23236 0.1 1.7 36300 17428 ? S 08:07 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 24509 0.1 1.6 35900 16700 ? S 08:11 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 24571 0.1 1.4 34572 15092 ? S 08:11 0:00 /usr/local/apache/bin/httpd -DSSL
    nobody 24684 0.1 1.5 35744 16224 ? D 08:12 0:00 /usr/local/apache/bin/httpd -DSSL
    nobody 24696 0.1 1.4 36452 15112 ? S 08:12 0:00 /usr/local/apache/bin/httpd -DSSL
    nobody 28632 0.0 1.0 33260 10460 ? S 08:22 0:00 /usr/local/apache/bin/httpd -DSSL
     
  4. dgbaker

    dgbaker Well-Known Member
    PartnerNOC

    Joined:
    Sep 20, 2002
    Messages:
    2,574
    Likes Received:
    3
    Trophy Points:
    343
    Location:
    Toronto, Ontario Canada
    cPanel Access Level:
    DataCenter Provider
    Grep through your domlogs directory for spy to see what domain it is being initiated from and then suspend the account until fixed.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. dezignguy

    dezignguy Well-Known Member

    Joined:
    Sep 26, 2004
    Messages:
    532
    Likes Received:
    0
    Trophy Points:
    166
    and be sure to remove those perl scripts as well after you do that, since they'll likely still be running and/or available to be run after you do that.
     
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice