[Marcos Malfredyne]

Galera desde de ontem comecei receber algumas mensagens no meu email de um VPS meu alguem sabe o que pode ser?

Time: Thu Oct 21 02:01:59 2010 -0200
Account: norteger
Resource: Process Time
Exceeded: 3736 > 1800 (seconds)
Executable: /usr/local/cpanel/whostmgr/docroot/whmsonic/inc/base/sc_serv
Command Line: ./sc_serv sc_serv.conf
PID: 2397
Killed: No

Time: Thu Oct 21 00:00:16 2010 -0200
PID: 21630
Account: norteger
Uptime: 14582 seconds


Executable:

/usr/local/cpanel/whostmgr/docroot/whmsonic/inc/base/sc_serv


Command Line (often faked in exploits):

./sc_serv sc_serv.conf


Network connections by the process (if any):

tcp: 208.115.245.84:7047 -> 0.0.0.0:0
tcp: 208.115.245.84:7046 -> 0.0.0.0:0
tcp: 208.115.245.84:7047 -> 187.44.18.190:62286


Files open by the process (if any):

/dev/null
/dev/null
/usr/local/cpanel/logs/error_log
/home/norteger/radio/sc_serv.log
/var/cpanel/locale/themes/x3/en.gdbm
/var/cpanel/locale/themes/x3/pt_br.gdbm
/home/norteger/radio/sc_w3c.log


Memory maps by the process (if any):

00899000-008b4000 r-xp 00000000 fd:00 6651982 /lib/ld-2.5.so
008b4000-008b5000 r-xp 0001a000 fd:00 6651982 /lib/ld-2.5.so
008b5000-008b6000 rwxp 0001b000 fd:00 6651982 /lib/ld-2.5.so
008b8000-00a0b000 r-xp 00000000 fd:00 6651985 /lib/libc-2.5.so
00a0b000-00a0d000 r-xp 00152000 fd:00 6651985 /lib/libc-2.5.so
00a0d000-00a0e000 rwxp 00154000 fd:00 6651985 /lib/libc-2.5.so
00a0e000-00a11000 rwxp 00a0e000 00:00 0
00a1a000-00a2f000 r-xp 00000000 fd:00 6651994 /lib/libpthread-2.5.so
00a2f000-00a30000 r-xp 00015000 fd:00 6651994 /lib/libpthread-2.5.so
00a30000-00a31000 rwxp 00016000 fd:00 6651994 /lib/libpthread-2.5.so
00a31000-00a33000 rwxp 00a31000 00:00 0
00d32000-00d42000 r-xp 00000000 fd:00 6653151 /lib/libresolv-2.5.so
00d42000-00d43000 r-xp 0000f000 fd:00 6653151 /lib/libresolv-2.5.so
00d43000-00d44000 rwxp 00010000 fd:00 6653151 /lib/libresolv-2.5.so
00d44000-00d46000 rwxp 00d44000 00:00 0
08048000-08066000 r-xp 00000000 fd:00 3080677 /usr/local/cpanel/whostmgr/docroot/whmsonic/inc/base/sc_serv
08066000-0806a000 rwxp 0001d000 fd:00 3080677 /usr/local/cpanel/whostmgr/docroot/whmsonic/inc/base/sc_serv
0806a000-0816d000 rwxp 0806a000 00:00 0
097a6000-097d6000 rwxp 097a6000 00:00 0 [heap]
b5ec8000-b5ed2000 r-xp 00000000 fd:00 6651952 /lib/libnss_files-2.5.so
b5ed2000-b5ed3000 r-xp 00009000 fd:00 6651952 /lib/libnss_files-2.5.so
b5ed3000-b5ed4000 rwxp 0000a000 fd:00 6651952 /lib/libnss_files-2.5.so
b5ede000-b5edf000 --xp b5ede000 00:00 0
b5edf000-b68df000 rwxp b5edf000 00:00 0
b68df000-b68e0000 --xp b68df000 00:00 0
b68e0000-b72e0000 rwxp b68e0000 00:00 0
b72e0000-b72e1000 --xp b72e0000 00:00 0
b72e1000-b7fb0000 rwxp b72e1000 00:00 0
b7fb1000-b7fb2000 rwxp b7fb1000 00:00 0
b7fb2000-b7fb6000 r-xp 00000000 fd:00 6651940 /lib/libnss_dns-2.5.so
b7fb6000-b7fb7000 r-xp 00003000 fd:00 6651940 /lib/libnss_dns-2.5.so
b7fb7000-b7fb8000 rwxp 00004000 fd:00 6651940 /lib/libnss_dns-2.5.so
b7fb8000-b7fba000 rwxp b7fb8000 00:00 0
b7fba000-b7fbb000 r-xp b7fba000 00:00 0 [vdso]
bfcc2000-bfcd7000 rw-p bffe9000 00:00 0 [stack]

[Seto Ichitaka]

Time: Thu Oct 21 02:01:59 2010 -0200
Account: norteger ---> usuário do servidor/cPanel
Resource: Process Time ---> processo em execucação
Exceeded: 3736 > 1800 (seconds) ---> tempo que o processo está sendo rodado
Executable: /usr/local/cpanel/whostmgr/docroot/whmsonic/inc/base/sc_serv ----> local do arquivo executado, no caso sc_serv é shoutcast, whmsonic é o programa que você instalou em seu servidor para fazer radios online.
Command Line: ./sc_serv sc_serv.conf ---> linha do comando em execução com o .conf da radio
PID: 2397 ---> número do processo.

Isto daí daria pra você saber jogando no google translate aonde indica o nome dos serviços. =x

[Marcos Malfredyne]

Vlw amigo obrigado.