ConfigServer Community Forum

Hi, we are getting this alert from all our WordPress installed. WP are updated and free malware. Why this? how can i stop it?

Time: Tue Mar 15 03:43:12 2016 +0100
PID: 17679 (Parent PID:16937)
Account: val2bornedo
Uptime: 69 seconds


Executable:

/usr/bin/php


Command Line (often faked in exploits):

/usr/bin/php /home/val2bornedo/public_html/wp-admin/admin-ajax.php


Network connections by the process (if any):

tcp: 136.243.83.24:46068 -> 136.243.83.24:80


Files open by the process (if any):

/var/cpanel/locale/en.cdb

It's the WP api. Hundreds of posts and different solutions abound on the internet. TRry a few and see which fit your needs.
I still struggle with it a bit myself.

https://www.google.com/#q=%2Fwp-admin%2Fadmin-ajax.php

You could add

cmd: /usr/bin/php /home/val2bornedo/public_html/wp-admin/admin-ajax.php

to the csf.pignore, Process Tracking if all you want to do is ignore the messages.

I wouldn't ignore it unless you have a beefy machine that can handle loads of crap requests like this.