Community forum to discuss cxs.
If you believe that there is a problem with your cxs installation and want support then, as a paid product, you should use the helpdesk after having consulted the documentation.
I understand about the false-positives (when the file doesn't exist), but I get a lot of e-mails having to do with viruses or fingerprints referring to files like:
or
These files get quarantined, but does that mean these wordpress files are exploitable and hackers are actually uploading files?
Or does this mean that someone did an apache POST and the...
I would like to know if by default cxs will run server-wide scan automatically (either by cronjob or other way?)
If yes, how to disable it?
Also I would like to know the command to scan one home dir only. Let say I want to scan /home/test/
What command I should run?
#!/bin/sh
#
# This file is part of the phpseclib project.
#
# (c) Andreas Fischer
#
# For the full copyright and license information, please view the LICENSE
# file that was distributed with this source code.
#
set -e
set -x
After enabling IP reputation integration, I had multiple occasions of cpanel monitoriog reporting lfd failures and subsequent restarts on 2 servers. From lfd.log I was able to determine that the URI::Escape module was not installed. I manually installed that and thought the lfd stops and starts would be corrected. Alas I am now seeing FASTART errors that seem to coincide with the failures. I...
I have the following report, is this a real or a false positive?
Thanks
/daveb
Scanning web upload script file...
Time : Tue, 19 Sep 2017 08:42:25 +1000
Web referer URL :
Local IP : 103.237.108.162
Web upload script user : nobody (99)
Web upload script owner: ()
Web upload script path : /home/purecalm/public_html/wp-content
Web upload script URL :...
Hello,
i have the latest version of CXS in cpanel.
Also i have some extra clamav rules from Atomicorp.
When i scan with clamscan -r -i /home/path/public_html
i can find some virus, for example Atomicorp.PHP.Malware.19.UNOFFICIAL FOUND
However when i scan with cxs, even if i enable all options for virus i find nothing.
For example:
/usr/sbin/cxs --report /var/log/cxs.scan --logfile...
I get people trolling I guess looking for scripts on the server to try to exploit.
I did change the username and domain name.
What I am wondering is how can I block and/or ban the IP address of the person after xx amount of hits?!?!
Scanning web upload script file...
Time : Mon, 4 Sep 2017 11:12:56 -0700
Web referer URL :
Local IP : 123.123.123.123
Web upload script user : nobody (99)
Web...
The root email address is receiving cxs scan emails fine which is excellent. How can one configured CXS to send an email to the script owner's email address as well notifying of the quarantined file?
CXS was installed without any problems. CPanel den ConfigServer Clicking Exploit Scanner gives an error. We have updated Cpanel. I restarted the services and it did not work. I'm waiting for your help.
I want to know what all the symbols mean which the process indicator is showing.
I found the following list but it looks like too old because I cannot find s or $ in it:
m = regex pattern match
M = fingerprint match
v = virus
O = socket
L = symlink
f = suspicious file
F = skipped directory with too many entries
S = SUID file
G = GUID file
c = core dump file
C = core dump file...
I keep getting this error when trying to start the daemon.. I have tried all the fixes on the net and in here.. but I still cant get that value to change.. I am using centos5...
Unable to start cxs Watch daemon: /proc/sys/fs/inotify/max_user_watches is set too low
I have tried changing the value via fs.inotify.max_user_watches = 65536 but I still get the above error...
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum