Member Avatar for enbeeone3

I scaned torjan from my whm . and i got following result

Possible Trojan - /usr/sbin/antirelayd

Possible Trojan - /usr/bin/xmlcatalog

Possible Trojan - /usr/bin/xmllint

Possible Trojan - /usr/bin/ptar

Possible Trojan - /usr/lib/python2.4/site-packages/libxml2mod.la

Possible Trojan - /usr/lib/python2.4/site-packages/libxml2mod.so

Possible Trojan - /etc/cron.daily/logrotate

Possible Trojan - /usr/bin/cpan

Possible Trojan - /usr/bin/instmodsh

Possible Trojan - /usr/bin/prove

Possible Trojan - /usr/sbin/pureauth

Possible Trojan - /usr/bin/spamd

Possible Trojan - /usr/bin/xml2-config

Possible Trojan - /usr/bin/dbiprof


14 POSSIBLE Trojans Detected

please someone tell me should i remove them or can suggest me what to do with them!

thanks in advance!

  • 2 Contributors
  • 2 Replies
  • 303 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by enbeeone3

Dani AI

Generated

Short version for : do not delete those files blindly — most of the names in the scanner output are legitimate CentOS/WHM/cPanel binaries or language tool scripts and are commonly flagged as false positives. ’s Malwarebytes suggestion is a Windows desktop tool and won’t scan a CentOS server; server-side verification is required.

Practical checklist (run from a safe shell, as root):

# find which RPM owns a file
rpm -qf /usr/bin/xmllint

# verify the installed package files
pkg=$(rpm -qf /usr/bin/xmllint)
rpm -V "$pkg"

# reinstall the package if files are modified/missing
yum reinstall -y "$pkg"    # (or `dnf reinstall` on newer systems)

# if a file is not owned by any package, inspect it before touching
file /usr/sbin/antirelayd
ldd /usr/sbin/antirelayd
strings /usr/sbin/antirelayd | head -n 40
sha256sum /usr/sbin/antirelayd

Why those names showed up (short): xmllint, xmlcatalog, xml2-config and the Python libxml2 module come from libxml2 (installed on any system that handles XML). The tools cpan, instmodsh, prove, ptar are standard Perl utilities. /etc/cron.daily/logrotate is the normal daily logrotate job. On WHM/cPanel systems antirelayd (TailWatch driver) and pureauth relate to cPanel/pure‑ftpd services, and spamd is the SpamAssassin daemon — i.e., common admin software, not automatically malware. (mirrorservice.org)

If rpm -qf shows “not owned”, and the binary looks suspicious (unexpected network listeners, recent mtime, odd strings), isolate the host (network), collect the file and logs, then restore from backups or reinstall the OS/package image. For rootkit hunting, run rkhunter/chkrootkit and a fresh ClamAV scan, but treat discovery carefully — forensic copies first, remediation from known-good packages/backups second.

Recommended Answers

All 2 Replies

Member Avatar for Rik_

Download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

Member Avatar for enbeeone3

Download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

i was talking about server not my desktop!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.