Search found 6 matches

by davert
26 May 2017, 16:42
Forum: General Discussion (csf)
Topic: suspicious process alert but no process listed
Replies: 3
Views: 3955

Re: suspicious process alert but no process listed

Just a bump to see if anyone found anything. It does show if something is running from a deleted process. It would be VERY nice if they showed what script was running the process. I have no idea where to look. There does seem to be a way to tell LFD to stop checking for processes running from delete...
by davert
13 Jan 2015, 23:41
Forum: General Discussion (cxs)
Topic: False alarm - exploited .htaccess P0767
Replies: 7
Views: 6809

Re: False alarm - exploited .htaccess P0767

Yup, that did it! Thanks again!
by davert
13 Jan 2015, 23:36
Forum: General Discussion (cxs)
Topic: False alarm - exploited .htaccess P0767
Replies: 7
Views: 6809

Re: False alarm - exploited .htaccess P0767

Thank you! I will make sure the ignore file is listed. There aren't actually any examples in the ignore.example file (which is what I'm using)… but you think that format should work? I'll try restarting Watch. Thanks again for the unexpectedly good support.
by davert
13 Jan 2015, 21:28
Forum: General Discussion (cxs)
Topic: False alarm - exploited .htaccess P0767
Replies: 7
Views: 6809

Re: False alarm - exploited .htaccess P0767

Thanks. I was going to ask you about that -- I have another file that I am trying to whitelist and it's not accepting it. Can't figure out if it's permissions or the format…

file:/home/user/public_html/directory/cl86f.dat
Also tried file:cl86f.dat

the cxs.ignore file doesn't have example syntax.
by davert
13 Jan 2015, 21:03
Forum: General Discussion (cxs)
Topic: False alarm - exploited .htaccess P0767
Replies: 7
Views: 6809

Re: False alarm - exploited .htaccess P0767

Thanks. There's more to the file so maybe something else set it off but given the timing of the signature list update, I think it's what I did…
by davert
13 Jan 2015, 19:47
Forum: General Discussion (cxs)
Topic: False alarm - exploited .htaccess P0767
Replies: 7
Views: 6809

False alarm - exploited .htaccess P0767

I am getting what I am pretty sure is a false alarm since I added this. I can find nothing on the "new signature" in P0767. Help? #Prevents showing indexes when there is no index.html etc Options -Indexes ServerSignature Off <filesMatch "\.(php)$"> Header append X-Frame-Options S...