"Suspicious File Alert" notification email

Discussion in 'General' started by ForexTalk11, Sep 12, 2017.

  1. ForexTalk11

    ForexTalk11 Member

    I got a lot of emails:
    ---------------------------------------------
    File: /tmp/lshttpd/bak_core/core.9609
    Reason: Linux Binary
    Owner: nobody:nobody (99:99)
    Action: No action taken

    And also a lof of email such as:
    ---------------------------------------------
    PID: 9611 (Parent PID:9603)
    Account: nobody
    Uptime: 60923 seconds


    Executable:

    /usr/local/lsws/bin/lshttpd.5.2.1


    Command Line (often faked in exploits):

    litespeed (lshttpd)
    ---

    Is that a bug please?

    Thanks.
     
  2. Jon K

    Jon K Administrator Staff Member

    please try the following to see if the messages stop.
    /usr/local/lsws/admin/misc/lsup.sh -d -f -v 5.2.1
     
  3. ForexTalk11

    ForexTalk11 Member

    It's not stop but sent more often, now I get 1 email each 5 mins. Any fix please?
    Thanks.
     
  4. NiteWave

    NiteWave Administrator

    you need empty /tmp/lshttpd/bak_core/ first.
    otherwise it'll keep sending emails.
    if no new file create in /tmp/lshttpd/bak_core/, then the issue fixed.
    otherwise, please log a ticket to better trace it until it's resolved.
     
  5. ForexTalk11

    ForexTalk11 Member

    How to empty /tmp/lshttpd/bak_core/ please?
    I purchase LiteSpeed via liquidweb so I don't get any login info!
     
  6. NiteWave

    NiteWave Administrator

    #rm -rf /tmp/lshttpd/bak_core/*
     
  7. ForexTalk11

    ForexTalk11 Member

    Still the same, after a days there have 80 new emails. Any way to fix this please?
     
  8. Jon K

    Jon K Administrator Staff Member

  9. JoseDieguez

    JoseDieguez Member

    that's LFD notification.. from CSF plugin on your install.

    you need to delete that file, and if it gets recreated frequently, contact LS Support.
     
  10. ForexTalk11

    ForexTalk11 Member

    How to delete that file please?
     
  11. NiteWave

    NiteWave Administrator

     

Share This Page