ConfigServer Community Forum

Getting lots of what appear to be false positives on the WordPress file:
default-widgets.php
since the WordPress 4.9.1 update.

as:
ClamAV detected virus =

Anyone else noticing this as well?

Thanks all!

Hello guys,

I have a server where CXS is installed, but when I try to run a manual scan it doesn't actually scan any files. It goes through all folders and that's it.

Here's what's happening:

# /usr/sbin/cxs --baction high --bayes --breport medium --clamdsock /var/clamd --deep --defapache nobody --report /var/log/cxs.scan --logfile /var/log/cxs.log --doptions Mv --exploitscan --fallback...

I get inundated with hacker activity, mainly exploiting Wordpress to install files which CSXS deletes or quarantines but nothing stops the same hackers on the same IP addresses from attacking multiple WP installs.

I don't know of a way to deal with the issue other than to manually block all of the IP addresses. Maybe blocking the IP addresses does no good as it seems I am chasing my tail. No...

Hi!

I find cxs very usefful on our Cpanel servers, and wish to use it on non-cpanel servers, to ensure their security.
I see that Cpanel is required, but i dont know if is viable use it (on limited way, or just only a few features) on non-cpanel server, or its not possible (and never be because...) use cxs on non Cpanel server.

Only i need is scan for files and daemon. Not need of interface or...

Hi there,

we're getting a lot of alerts for exploit P1410 but the affected files seem to be a simple archive script included in a lot of apps like coppermine, joomla extensions, CMS Made Simple and so on. The apparently bad file is even included in official sources of the named products. I don't know if maybe some malware used partially the same code as the legitimate script and now all are...

I am getting hundreds of alerts, like this:

'/home/USERNAME/public_html/wp-content/plugins/jetpack/modules/widgets/google-translate.php'
Script version check

It can't be that every user on all servers has a bad version of this module, included with Jetpack. Could this be a false positive?

- Scott

Hope someone can clarify something.

I understand about the false-positives (when the file doesn't exist), but I get a lot of e-mails having to do with viruses or fingerprints referring to files like:

or

These files get quarantined, but does that mean these wordpress files are exploitable and hackers are actually uploading files?

Or does this mean that someone did an apache POST and the...

I would like to know if by default cxs will run server-wide scan automatically (either by cronjob or other way?)
If yes, how to disable it?
Also I would like to know the command to scan one home dir only. Let say I want to scan /home/test/
What command I should run?

Many thanks in advance.

regards,
H

CXS service is not running.

I have cxs installed in our server. It is starting but the status is showing as

====
root@server # service cxswatch status
Status of cxswatch daemon: Stopped
====

====
root@server # ps aux | grep cxs
root 10255 0.0 0.0 105368 904 pts/0 S+ 19:07 0:00 grep cxs
root 1044139 0.7 0.1 251840 59448 ? Ds 18:55 0:05 cxswatch starting...
root 1044157 0.0 0.1 226764 33280 ? S...

Hello
i found a file it have this code

#!/bin/sh
#
# This file is part of the phpseclib project.
#
# (c) Andreas Fischer
#
# For the full copyright and license information, please view the LICENSE
# file that was distributed with this source code.
#
set -e
set -x

USERNAME='phpseclib'
PASSWORD='EePoov8po1aethu2kied1ne0'

# Create phpseclib user and home directory
sudo useradd --create-home...

Hi Guys,
Examples I'm trying to match (last 5 chars random):
/tmp/.xcloner-10d02
/tmp/.xcloner-a714a
/tmp/.xcloner-f6e8e

My cxs.ignore rule:
pdir:^\/tmp\/\.xcloner- +$

Still getting notified. Yes, I've restarted cxs Watch. Please help - thanks :)

Hi guys:
Which are step to migrate csx from old server to new server, putting config from old cxs in new cxs server, but diferent ip??
Regards.

After enabling IP reputation integration, I had multiple occasions of cpanel monitoriog reporting lfd failures and subsequent restarts on 2 servers. From lfd.log I was able to determine that the URI::Escape module was not installed. I manually installed that and thought the lfd stops and starts would be corrected. Alas I am now seeing FASTART errors that seem to coincide with the failures. I...

Hi,

Sorry new to CSX so be gentle :-)

I have the following report, is this a real or a false positive?

Thanks
/daveb

Scanning web upload script file...
Time : Tue, 19 Sep 2017 08:42:25 +1000
Web referer URL :
Local IP : 103.237.108.162
Web upload script user : nobody (99)
Web upload script owner: ()
Web upload script path : /home/purecalm/public_html/wp-content
Web upload script URL :...

Searched and found this link.

After entering the command, I get a return to prompt with no output.

OS is CENTOS 6.8 standard v66.0.22

tried CSF -u got this

root@chaos # csf -u
Oops: Unable to download: Can't connect to download.configserver.com:443 (timeout)

Hello,
i have the latest version of CXS in cpanel.
Also i have some extra clamav rules from Atomicorp.
When i scan with clamscan -r -i /home/path/public_html
i can find some virus, for example Atomicorp.PHP.Malware.19.UNOFFICIAL FOUND
However when i scan with cxs, even if i enable all options for virus i find nothing.
For example:
/usr/sbin/cxs --report /var/log/cxs.scan --logfile...

I get people trolling I guess looking for scripts on the server to try to exploit.
I did change the username and domain name.
What I am wondering is how can I block and/or ban the IP address of the person after xx amount of hits?!?!

Scanning web upload script file...
Time : Mon, 4 Sep 2017 11:12:56 -0700
Web referer URL :
Local IP : 123.123.123.123
Web upload script user : nobody (99)
Web...

Hello,

I dont know how to report code not detected by CXS, so this is my contribution:

I found this today: a process running on my server, mining bitcoin or something like this.

The process:

The code I found on file:

So, this code download a binary and run on the server.

Hope CXS team can add this to be detected, because the CXS 6.39 (running as daemon cxswatch) dont detected today....