Good morning,

This file has been flagged repeatedly but it appears that it may be legit. Can someone confirm?

cxswatch Scanning /home/terrysco/public_html/wordpress/wp-includes/js/plupload/plupload.silverlight.xap:
# (compressed file: plupload.silverlight.dll) MS Windows Binary/Executable :
'/home/homedir/public_html/wordpress/wp-includes/js/plupload/plupload.silverlight.xap'

thanks,
dean

What cron is cxs supposed to be going to when I use the submit cron feature from the WHM interface? I don't see it in root cron. I also noticed that cxs did not run automatically after setting it up. Obviously I can manually place the cron job in root cron, I just wanted to make sure. Thanks.

15226 root 18 0 40652 34m 1412 D 14.4 0.6 0:13.98 cxswatch starting...

I see the cxswatch starting... process continuously running on a few of our servers. On one inparticular it seems to produce a significant load:

We do need this daemon to run.

Here are the results of:

ps -ef | grep cxs

root 15226 1 6 04:22 ? 00:00:26 cxswatch starting...
root 15228 15226 0 04:22 ? 00:00:00 cxswatch -...

hi
Once installed cxs
in whm >>>>cxs plugin
ConfigServer eXploit Scanner - cxs version failed at /usr/local/cpanel/whostmgr/docroot/cgi/addon_cxs.cgi line 19.
and not start cxs watch

Help please

the CXS investigated and put some files in quarantine, and these files were not normal and restore the files when they return blank in the user account, anyone there to help me know how much work it, now a thank you

Hi

We have a problem with a typo3 installation and cxs / modsec.
When saving a page in typo3 backend the following error messages appear:

Error in init.php: Path to TYPO3 main dir could not be resolved correctly.

This happens if the last 6 characters of this path, ..../etc/cxs/ (end of $temp_path), is NOT typo3/ for some reason.
You may have a strange server configuration. Or maybe you...

Some sites with Wordpress and the plugin Better WP Security result in :
Known exploit = [Exploited .htaccess ]:

¿Is an exploit or a false positive?

.htacces contet:

# BEGIN Better WP Security
Options -Indexes

Order allow,deny
Allow from all
Deny from 81.114.75.174

Order allow,deny
Deny from all

Order allow,deny
Deny from all

Order allow,deny
Deny from all

Order allow,deny...

Hi,

tonight several sites was hacked, one on my server... cxs has scan that user

cxswatch Scanning /home/user/public_html/templates/atomic/error.php:
# (quarantined to /home/quarantine/scan/user/error.php.1355351045_1) ClamAV detected virus = :
'/home/user/public_html/templates/atomic/error.php'

----------- SCAN SUMMARY -----------
Scanned directories: 0
Scanned files: 1
Ignored items: 0...