Topic: lfd on myserver: Suspicious process running under user

Hi All,

I’ve looked at the XStore theme requirements and everything has been configured correctly. However, there are two plugins that keeps on failing with the Theme Setup. Revolution Slider and Visual Composer.

During the Download and Install process I get notified by lfd on my cpanel server that there is a suspicious process running under the user.

This seems to cause a roleback and the two plugins will not install.

Any advice would be appreciated.

Time: Tue May 16 07:41:15 2017 +1000
PID: 6404 (Parent PID:5067)
Account: wiseshopper
Uptime: 65 seconds

Executable:

/opt/cpanel/ea-php56/root/usr/bin/php-cgi

Command Line (often faked in exploits):

/opt/cpanel/ea-php56/root/usr/bin/php-cgi

Network connections by the process (if any):

tcp: myserverip -> 50.63.202.49:80

Files open by the process (if any):

/var/log/apache2/error_log
/tmp/.ZendSem.w6aWdq (deleted)
/dev/urandom
/tmp/js_composer-pECPEY.tmp