Ok, so I awoke and as I usually do checked my servers for compromises.

How would you feel if you just woke up in the morning and saw this:

cxs Scan on ds10.myserver.com (Hits:4017) (Viruses:0) (Fingerprints:3875)

My God!
Just about fainted flat out of my Herman Miller.

Why the heck you marking this as a fingerprint???

Arghh!!!

Hi,

Lately I have seen on cPanel servers alot of multi FTP hacks.

- Attacker logs in with FTP username/pass of cPanel account (from where these come no one knows)
- Attacker uploads files (shells/.htaccess spam links / mailers etc)
- Does this to most accounts on same server in short period of time.

Result: fast defacement of most/all sites on a server.

I would like to suggest a feature...

As subject says. I could not find anywhere what values are valid for Throttle? 0-10? 1-100?

Thanks,

Gleb

Can you tell me how to automatically quarantine these types of files

----------- SCAN REPORT -----------
(/usr/sbin/cxs --allusers --clamdsock /tmp/clamd --deep --doptions Mv --exploitscan --filemax 0 --ignore /etc/cxs/cxs.ignore --logfile /var/log/cxs.log --mail --options mMOLfSGchexdnwZDRu --qoptions Mv --quarantine /home/quarantine --quiet --report /var/log/cxs.scan --sizemax 500000 --smtp...

How can i block these iframe hacks, for example with the cxs.xtra file?

Does Anti-Gumblar work with CXS if that is a solution ?

Or is it possible to stop and block uploads if a file contains at the bottom no matter how much whitespace is in between:

Because almost always the iframe hacks are at the end of the file near the ending body tag.

hello,

i just installed cxs and scan my server

after i did this, i received several emails like this

cxswatch failed @ Fri Mar 8 19:43:15 2013. A restart was attempted automagically.
Service Check Method:
Number of Restart Attempts: 4

i rebooted my server and i still receive this

any ideas ?

Hi,

My iteration of CXS used to work, and all of a sudden ceased working. I am getting this error when attempting to launch it.

ConfigServer eXploit Scanner - cxs version failed at /usr/local/cpanel/whostmgr/docroot/cgi/addon_cxs.cgi line 19.

I searched the error and didn't find anything useful. Is this a known issue? Is there an easy solution?

thanks
dan

In each log scanner report I receive each hour there are references to

/var/log/cxswatch.log: (example follows)

Apr 4 15:34:07 buxton cxswatch : WARNING: '/home/waimeanu/public_html/silverstripe-cache/cache/zend_cache---internal-metadatas---i18nZend_Translate_RailsYaml_Options' scanned 6 times in the last 30 seconds, you might want to ignore this resource
Apr 4 15:34:07 buxton cxswatch :...

I upload phpproxy but cxs plugin removed this script
how i allow this is script to cxs or allow 1 folder to cxs plugin?

Hi,

i receive a report(Email) form CXS when someone upload php-shell script.
i want to get upload-er IP in report.

Too many false positives with Suspicious File Location scanning, and if we whitelist/ignore them with regex, then it also stops virus scanning those locations, which is too dangerous... so... we are going to disable Suspicious File Location scanning, for now.

We have cxswatch configured as:

/usr/sbin/cxs --options mMOLfSGchexdnwDZR --Wstart --allusers --www --smtp -Q /home/quarantine --qoptions...

First I contact cPanel support, investigating it they found that the
CallUploadScript yes causing the problem.

All that immediately after today's update.

Is there a fix / walkthrough,? it's a bug ? I should remove from all server the
CallUploadScript parameter at least temporary ?

Hello,

We use CloudLinux. In the daily scan e-mail I receive this output in most of the users:

(174) USERNAME, Scanning /home/alespa:
# Socket:
'/home/USERNAME/.cagefs/tmp/mysql.sock'

The files are symlink to mysql.sock:

root@HOST # ls -la '/home/USERNAME/.cagefs/tmp/mysql.sock'
lrwxrwxrwx 1 root nobody 25 Mar 5 19:33 /home/USERNAME/.cagefs/tmp/mysql.sock -> /var/lib/mysql/mysql.sock...

Hi,

How do i add some custom rule?

I found out some file with name dvmessages.php causing ddos on joomla site and i want cxs clean it every cron is running. Any idea how to do it?

dvmessages.php file contains:

defined( '_JEXEC' ) or die(@eval(base64_decode($_REQUEST )));
jimport( 'joomla.plugin.plugin' );

The CXS watch process is causing heavy load on the server.
A reboot is required to recover the server

Even running the process with a nice value and setting --Wsleep and --throttle doesnt improve the situation

nice -n 19 /usr/sbin/cxs --Wstart --allusers --www --smtp -Q /home/quarantine --qoptions Mv --mail root --Wmaxchild 3 --Wloglevel 0 --Wsleep 6 --filemax 0 --Wrateignore 300 --throttle 2...

Hello,

Im trying to set cxs to quarantine all files or folders named root or sym but it does not work. Mybe Im not using it correctly, Im placing roules in cxs.extra like this:
file:root
file:sym
regfile:root
regfile:sym

In this case I have set 4 type but eaven if I use only one type like file:sym and if I place folder named sym in some users account the cxs will not quarantine it. Could you...

We already installed CXS on our servers but we are still getting phishing complaints. Most of the complaints are subdomains being created by someone else.

Any suggestion or help?

Updating to cPanel 11.36 I see in every module
(cxs / modsec / csf) this error:

Can't use string ( _defheader.tmpl ) as a HASH ref while strict refs in use at /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi/Template/Context.pm line 809.