Suspicious Process WordPress

Post Reply
conecta6
Junior Member
Posts: 2
Joined: 15 Mar 2016, 08:29

Suspicious Process WordPress

Post by conecta6 »

Hi, we are getting this alert from all our WordPress installed. WP are updated and free malware. Why this? how can i stop it?

Time: Tue Mar 15 03:43:12 2016 +0100
PID: 17679 (Parent PID:16937)
Account: val2bornedo
Uptime: 69 seconds


Executable:

/usr/bin/php


Command Line (often faked in exploits):

/usr/bin/php /home/val2bornedo/public_html/wp-admin/admin-ajax.php


Network connections by the process (if any):

tcp: 136.243.83.24:46068 -> 136.243.83.24:80


Files open by the process (if any):

/var/cpanel/locale/en.cdb
ColumbusGEEK
Junior Member
Posts: 12
Joined: 10 Apr 2010, 01:11

Re: Suspicious Process WordPress

Post by ColumbusGEEK »

It's the WP api. Hundreds of posts and different solutions abound on the internet. TRry a few and see which fit your needs.
I still struggle with it a bit myself.

https://www.google.com/#q=%2Fwp-admin%2Fadmin-ajax.php
nootkan
Junior Member
Posts: 94
Joined: 26 Aug 2007, 22:40

Re: Suspicious Process WordPress

Post by nootkan »

You could add
cmd: /usr/bin/php /home/val2bornedo/public_html/wp-admin/admin-ajax.php
to the csf.pignore, Process Tracking if all you want to do is ignore the messages.
ColumbusGEEK
Junior Member
Posts: 12
Joined: 10 Apr 2010, 01:11

Re: Suspicious Process WordPress

Post by ColumbusGEEK »

I wouldn't ignore it unless you have a beefy machine that can handle loads of crap requests like this.
Post Reply