The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Who is running this: /hsphere/shared/apache/bin/httpd -DSSL ?

Discussion in 'EasyApache' started by EdRooney, Dec 28, 2004.

  1. EdRooney

    EdRooney BANNED

    Joined:
    Oct 21, 2004
    Messages:
    166
    Likes Received:
    0
    Trophy Points:
    0
    Whois is running perl?

    # cat /proc/15118/cmdline
    /hsphere/shared/apache/bin/httpd -DSSL

    #cat /proc/15118/environ
    hared/apache/bin/httpd -DSSL

    What user is running this?
    /hsphere/shared/apache/bin/httpd -DSSL
     
  2. mike_r

    mike_r Well-Known Member

    Joined:
    Nov 26, 2002
    Messages:
    45
    Likes Received:
    0
    Trophy Points:
    6
  3. EdRooney

    EdRooney BANNED

    Joined:
    Oct 21, 2004
    Messages:
    166
    Likes Received:
    0
    Trophy Points:
    0
    Tried, it but it is sitll running:
    root 17116 0.0 0.1 33220 1392 ? S Dec28 0:02 /usr/local/apache/bin/httpd -DSSL
    nobody 17140 0.0 1.3 37976 14152 ? S Dec28 0:08 /usr/local/apache/bin/httpd -DSSL
    nobody 17144 0.0 1.3 38328 14228 ? S Dec28 0:14 /usr/local/apache/bin/httpd -DSSL
    nobody 17158 0.0 1.7 37112 18252 ? S Dec28 0:22 /usr/local/apache/bin/httpd -DSSL
    nobody 17175 0.0 1.3 40016 14040 ? S Dec28 0:12 /usr/local/apache/bin/httpd -DSSL
    nobody 14591 0.0 1.3 38652 14020 ? S 00:14 0:03 /usr/local/apache/bin/httpd -DSSL
    nobody 20877 0.0 0.1 4252 1456 ? S 00:37 0:00 /usr/local/sbin/httpd - spy
    nobody 24708 0.0 0.1 6584 1516 ? S 00:49 0:04 /usr/local/sbin/httpd - spy
    nobody 12702 0.0 0.1 6428 1516 ? S 01:55 0:03 /usr/local/sbin/httpd - spy
    nobody 17957 0.1 0.2 6816 3048 ? S 05:55 0:14 /usr/local/sbin/httpd - spy
    nobody 20533 0.1 0.2 6696 3048 ? S 06:06 0:14 /usr/local/sbin/httpd - spy
    nobody 32506 0.1 0.1 6456 1516 ? S 06:49 0:08 /usr/local/sbin/httpd - spy
    nobody 2807 0.1 0.4 6516 4280 ? S 06:59 0:08 /usr/local/sbin/httpd - spy
    nobody 20962 0.1 0.2 6340 2648 ? S 08:02 0:02 /usr/local/sbin/httpd - spy
    nobody 23018 0.1 0.2 4152 2552 ? S 08:07 0:01 /usr/local/sbin/httpd - spy
    nobody 23035 0.1 1.5 35652 15496 ? S 08:07 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 23077 0.1 1.4 36788 14432 ? S 08:07 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 23087 0.1 1.5 36520 15456 ? D 08:07 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 23088 0.1 1.4 34528 15076 ? S 08:07 0:00 /usr/local/apache/bin/httpd -DSSL
    nobody 23236 0.1 1.7 36300 17428 ? S 08:07 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 24509 0.1 1.6 35900 16700 ? S 08:11 0:01 /usr/local/apache/bin/httpd -DSSL
    nobody 24571 0.1 1.4 34572 15092 ? S 08:11 0:00 /usr/local/apache/bin/httpd -DSSL
    nobody 24684 0.1 1.5 35744 16224 ? D 08:12 0:00 /usr/local/apache/bin/httpd -DSSL
    nobody 24696 0.1 1.4 36452 15112 ? S 08:12 0:00 /usr/local/apache/bin/httpd -DSSL
    nobody 28632 0.0 1.0 33260 10460 ? S 08:22 0:00 /usr/local/apache/bin/httpd -DSSL
     
  4. dgbaker

    dgbaker Well-Known Member
    PartnerNOC

    Joined:
    Sep 20, 2002
    Messages:
    2,578
    Likes Received:
    3
    Trophy Points:
    38
    Location:
    Toronto, Ontario Canada
    cPanel Access Level:
    DataCenter Provider
    Grep through your domlogs directory for spy to see what domain it is being initiated from and then suspend the account until fixed.
     
  5. dezignguy

    dezignguy Well-Known Member

    Joined:
    Sep 26, 2004
    Messages:
    534
    Likes Received:
    0
    Trophy Points:
    16
    and be sure to remove those perl scripts as well after you do that, since they'll likely still be running and/or available to be run after you do that.
     
Loading...

Share This Page