Hello,
i have the latest version of CXS in cpanel.
Also i have some extra clamav rules from Atomicorp.
When i scan with clamscan -r -i /home/path/public_html
i can find some virus, for example Atomicorp.PHP.Malware.19.UNOFFICIAL FOUND
However when i scan with cxs, even if i enable all options for virus i find nothing.
For example:
/usr/sbin/cxs --report /var/log/cxs.scan --logfile...

I get people trolling I guess looking for scripts on the server to try to exploit.
I did change the username and domain name.
What I am wondering is how can I block and/or ban the IP address of the person after xx amount of hits?!?!

Scanning web upload script file...
Time : Mon, 4 Sep 2017 11:12:56 -0700
Web referer URL :
Local IP : 123.123.123.123
Web upload script user : nobody (99)
Web...

Hello,

I dont know how to report code not detected by CXS, so this is my contribution:

I found this today: a process running on my server, mining bitcoin or something like this.

The process:

The code I found on file:

So, this code download a binary and run on the server.

Hope CXS team can add this to be detected, because the CXS 6.39 (running as daemon cxswatch) dont detected today....

Hello, I just purchased CXS and implemented to my server, WHM&cPanel

everything works fine, except one thing:

after i enable cxs ModSecurity Scanning - Install and Enable Apache ModSecurity scanning

I can login to my website, but i can't edit pages. when i click update or submit, system will tell me : Forbidden You don't have permission to access / on this server

if i disable cxs...

Hello,

Is it possible to add multiple email recipients for the -mail option in CXS command line?

Thanks.

Current Version: ConfigServer eXploit Scanner - cxs v6.35
Running in Unrestricted Mode

Trying to upgrade to v6.38 and i get the following error:

Upgrading cxs...

Upgrading cxs from v6.35 to 6.38...
Retrieving new cxs installer...
...100%

Unpacking new cxs package...

gzip: stdin: unexpected end of file
tar: Child returned status 1
tar: Error is not recoverable: exiting now
sh: line 0: cd:...

Hi everybody,
I wonder if there is a way to scan exist files? If you know, please tell me!
Thank you!

Hello Chirpy!

The root email address is receiving cxs scan emails fine which is excellent. How can one configured CXS to send an email to the script owner's email address as well notifying of the quarantined file?

Thank you.

CXS was installed without any problems. CPanel den ConfigServer Clicking Exploit Scanner gives an error. We have updated Cpanel. I restarted the services and it did not work. I'm waiting for your help.

Error;

Hello,
In my servers I have Nginx as reverse proxy,
In modsecuity the OWASP rules show the correct remote IP,... but with the CXS Rules.. it show the server IP instead the real remote IP.
¿Any ideas abut how correct this issue?

I want to know what all the symbols mean which the process indicator is showing.

I found the following list but it looks like too old because I cannot find s or $ in it:

m = regex pattern match
M = fingerprint match
v = virus
O = socket
L = symlink
f = suspicious file
F = skipped directory with too many entries
S = SUID file
G = GUID file
c = core dump file
C = core dump file...

hello

i buy 2 licens cxs and install on my server
but cxs detection this file as virus
easy-digital-downloads/includes/process-download.php

and i must ignore this file on all cpanel users.

It is very difficult

i use this coment
file:home/*/public_html/wp-content/plugins/easy-digital-downloads/includes/process-download.php

* =all user

but I did not get a positive result

palse help me for...

I've recently added quarantine form cxsftp and enabled the service, but it seems that any PHP script that gets uploaded I'm notified.

Scanning FTP file...
Time : Thu, 15 Jun 2017 14:10:32 -0300
FTP user : webmaster@*******.***
FTP file : /home/*******/public_html/*******/page.php
FTP owner : ******* (882)
FTP file md5sum : *******
Remote IP : *******
Blocked : No
Deleted : No
Quarantined : No...

Hello, I am researching excessive problems with what appeared to be a Wordpress exploit allowing all sorts of malicious activity.

I got accustomed to seeing messages like this:

Scanning web upload script file...
Time : Thu, 8 Jun 2017 23:45:45 -0500
Web referer URL :
Local IP : 75.126.215.47
Web upload script user : nobody (99)
Web upload script owner: notsayin (596)
Web upload script path :...

I keep getting this error when trying to start the daemon.. I have tried all the fixes on the net and in here.. but I still cant get that value to change.. I am using centos5...

Unable to start cxs Watch daemon: /proc/sys/fs/inotify/max_user_watches is set too low

I have tried changing the value via fs.inotify.max_user_watches = 65536 but I still get the above error...

Anybody have an idea...

At 0500 I received this notification:

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/sbin/cxs: FAILED

Usually when I get a notification like that it's preceded by a notification of an automatic...

Hi Guys,
I have several warning notices like the below, mostly for suspicious directories and/or cache directories. I've setup the relative 'ignore' lines and they dont bother me anymore. The only one I am having trouble understanding is for a particular user as follows:
May 24 09:50:04 osi cxswatch : .....148000 May 24 09:55:39 osi cxswatch : WARNING: '/home/userABC/public_html/.htaccess'...

How can I change --filemax 10000 to --filemax 20000 for the weekly scan ?

This is more a feature request, unless there's already a way to do this.

I always have to change some options on the web scan (ie. enable Bayes, setup the Quarantine directory, choose which files to check, ignore files, etc) and sometimes I forget something or get something wrong which causes me to repeat the test.

I wonder if there's a chance to always keep the last used variables as the...

I keep getting false positive for (cxswatch Scanning /home/user/public_html/wp-content/cache/supercache/www.userdomain.com).

I have already put (hdir:/public_html/wp-content/cache/supercache) in cxs.ignore and restarted the service.

I still keep seeing many email regarding the same false positive any help would be great.