|
MrPhil
|
 |
« Reply #4 on: December 10, 2010, 08:22:03 PM » |
|
Are they saying that you added a script to /usr/sbin (and are running it)? That doesn't make sense, as there shouldn't be any way for you (or even a hacker who has compromised your site) to do anything but read/execute something that's already there. On the other hand, you might well be running a standard system script or tool that lives in that directory, and doing it to excess. Presumably this is a shared server, and not VPS or dedicated, where you would own /usr/sbin anyway. If your account actually did manage to install something to a public directory, that would be LP's security problem, not yours. I think the first thing to do would be to find out what script is running, and who owns it (you?). If it belongs there (not owned or installed by you), you need to see if you have something installed on your site (either by you, such as in canned software, or by a hacker) that is invoking this script excessively and needs to be tamed or removed. If you don't know how to "grep" your files for the command/script in question, ask support to do it for you. While you're at it, you can do an ls -la /usr/sbin/commmand name to find out who owns it. Something strange is going on here. Most likely, a hacker or piece of canned software is calling a legit system script to excess, and you misunderstood what you were told.
|