hi all
the lasted update CXS installed in cpanel
Anti shller can not identify it either

for expamle

This shell can be easily uploaded to the host with the extension sh
Antishler can not identify it either

Is it possible to run on this cpanel host?
Thanks

I had some scans before
Have the option to make suspicious files Quarantine
But the report after the scan didn't know why it wasn't sent to my mailbox.
Because it is a series of scanning activities
Don't know where to find the previous scan report?

Hello,

In my daily scan I use the following crontab:

/usr/sbin/cxs -mail ###@#####.## --exp --novir -o mMOSGchdnD -Z --sum -T 5 -all --ignore /etc/cxs/cxs.ignore

for some reason in more than a dozen servers I received today about 50-200 hits per server with the following reason:

# Regular expression match = :
'/home/USERNAME/public_html/cp2/libraries/pear/archive_tar/Archive_Tar.php'

I...

just wondering after the corrupt sig issue the other day what the correct way to empty the quarantine of all the files and the database for them so we can start fresh?

Hello,

Each time I disable the Email configuration via your WHM command wizard UI (for watch and daily/weekly cron), the setting is saved but upon returning to the wizard the option is checked again which would result in the option being enabled when reconfiguring the command.

Generated command/config showing email is disabled:

Wizard, after returning to it when previously disabling the email...

Hello,

I wanted to know if there is a way to not send CXS's results via mail. Even when I don't use --mail reports are sent anyways.

I am scanning lots of accounts and I don't need to receive an email for each one of them. I only need those report stored in a file, so I can read it when if I need to.

Thanks.-

As of today I am getting hundreds of Hit emails out of the blue regarding the Wordpress plugin file:

'/wp-content/uploads/sucuri/sucuri-settings.php'

(quarantined to /home/quarantine/cxsuser/ /sucuri-settings.php.1521654621_1) Known exploit =

The quarantined file contains the following file contents:

{ sucuriscan_lastlogin_redirection : enabled , sucuriscan_revproxy : disabled }

Perhaps...

Hi,
I had an issue with the firewall blocking a client who's password was changed and her phone kept trying to login triggering the bad login attempts. Since the firewall on the server changed, it took me a while to figure out that is what was happening.

If I enable IP Reputation, I have 3 concerns/questions.

1) If a client starts getting blocked and the cause is something like the situation...

Hello, for a couple of days I have been observing a lot of processes of the type that I copy, consuming a lot of CPU. What could be the reason for this? How to improve this?

/usr/local/cpanel/3rdparty/bin/perl /usr/sbin/cxs --quiet --cgi --smtp -Q /home/quarantine --qoptions Mv --mail root /tmp/20180213-101404-WoKsXDM0nATHpttXnR3e9QAAARQ-file-jOooCug

thanks
miguel

So my issue is the following:

In CXS 8 the very first option is:

What to scan:
If scanning a user, only scan within in the web root (e.g. ~user/public_html/)

Now, WHM Teak Settings has:

Restrict document roots to public_html which we have set to Disabled on all 25 production servers.

Which means that Addon Domains are created in /home/user/wordpress2 instead of...

I get an alert on every file that is uploaded - T option is not enabled/checked on either FTP or Regular scan.

Example
Scanning /home/XXXXX/public_html/hosting/modules/support/Zendesk/class.jwt.php:

(/usr/sbin/cxs --baction high --bayes --breport medium --clamdsock /var/clamd --nodbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 10000 --noforce --html --mail root...

Awesome sounding new features!

Hi
1-I purchased cxs scanner and every time i do manual scan to all of my whm account after the scan does finish i see that some of my whm account was deleted without my permission.what shoud i do to prevent delet my whm account?
next question is that i have phishing in my server but cxs doesn't detect and remove theme and i receive abuse from datacenter every day
thanks

Hi,

I would like to know if I need to enable Apache SpamAssassin™ on our VPS Server or not. We have ConfigServer eXploit and mail scanner already installed

Thanks

Junaid Hussain
Riyadh
Saudi Arabia

Getting lots of what appear to be false positives on the WordPress file:
default-widgets.php
since the WordPress 4.9.1 update.

as:
ClamAV detected virus =

Anyone else noticing this as well?

Thanks all!

Hello

I recently get a lot of ModSecurity false-positive alerts and a little search lead me to this post :

So I set LF_APACHE_404 to 60 but but my problem is that attacks are from different IP's!
Is there another parameter to help this problem?

Hello guys,

I have a server where CXS is installed, but when I try to run a manual scan it doesn't actually scan any files. It goes through all folders and that's it.

Here's what's happening:

# /usr/sbin/cxs --baction high --bayes --breport medium --clamdsock /var/clamd --deep --defapache nobody --report /var/log/cxs.scan --logfile /var/log/cxs.log --doptions Mv --exploitscan --fallback...

I get inundated with hacker activity, mainly exploiting Wordpress to install files which CSXS deletes or quarantines but nothing stops the same hackers on the same IP addresses from attacking multiple WP installs.

I don't know of a way to deal with the issue other than to manually block all of the IP addresses. Maybe blocking the IP addresses does no good as it seems I am chasing my tail. No...