ConfigServer Community Forum

Im getting 2 emails an hour about a maintenance process using wget

Ive tried adding the process to a ignore files a couple different ways and have not been successful

Any pointers would be helpful

Time: Mon Apr 11 07:01:44 2011 -0500
PID: 18054
Account: taccpount
Uptime: 102 seconds

Executable:
♦

Command Line (often faked in exploits):

wget -q -O /dev/null http://www.domain.com/banners/maintenan ... enance.php

this server has been running CSF for years and these emails are a recent development

here is what I tried - maybe I formatted it wrong

csf.fignore

/home/accountsv/public_html/banners/maintenance/.*
/home/accountm/public_html/banners/maintenance/.*

csf.signore

/home/accountv/public_html/banners/maintenance/maintenance.php
/home/accountm/public_html/banners/maintenance/maintenance.php
/home/accountv/public_html/banners/maintenance
/home/accountm/public_html/banners/maintenance

You need to add the executable to csf.pignore, the two files you edited are nothing to do with Process Tracking.

I need to add a wget process to the ignore file, but I'm not sure what it should look like in the file. Here is the process:
wget --user=fakeinfo --password=verysecureright ftp://ftp2.fakesite dot com/thefolder/ -r -m -nH --cut-dirs=2 -P /home/user/public_html/path/to/folder/

So, can anyone advise what the actual line in my pignore file should read in order to ignore this process?

Thanks so much!