Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : 51 Trojans on Server!?

[binchaud]

Did a "Trojan Check" through WHM Security Panel.
It listed the summary as "51 POSSIBLE Trojans Detected".

Are these viable trojans? If they aren't, is it just WHM acting up? If they are what can we do to fix this?

Possible Trojan - /usr/bin/sa-learn
Possible Trojan - /usr/bin/spamassassin
Possible Trojan - /usr/bin/spamc
Possible Trojan - /usr/bin/spamd
Possible Trojan - /usr/bin/dbiprof
Possible Trojan - /etc/logd/scripts/logfiles/cron/applydate
Possible Trojan - /etc/logd/scripts/logwatchpl
Possible Trojan - /etc/logd/scripts/services/afpd
Possible Trojan - /etc/logd/scripts/services/arpwatch
Possible Trojan - /etc/logd/scripts/services/automount
Possible Trojan - /etc/logd/scripts/services/autorpm
Possible Trojan - /etc/logd/scripts/services/cron
Possible Trojan - /etc/logd/scripts/services/dhcpd
Possible Trojan - /etc/logd/scripts/services/exim
Possible Trojan - /etc/logd/scripts/services/ftpd-messages
Possible Trojan - /etc/logd/scripts/services/ftpd-xferlog
Possible Trojan - /etc/logd/scripts/services/identd
Possible Trojan - /etc/logd/scripts/services/inqpopper
Possible Trojan - /etc/logd/scripts/services/init
Possible Trojan - /etc/logd/scripts/services/ipop3d
Possible Trojan - /etc/logd/scripts/services/kernel
Possible Trojan - /etc/logd/scripts/services/modprobe
Possible Trojan - /etc/logd/scripts/services/mountd
Possible Trojan - /etc/logd/scripts/services/named
Possible Trojan - /etc/logd/scripts/services/pam
Possible Trojan - /etc/logd/scripts/services/pam_pwdb
Possible Trojan - /etc/logd/scripts/services/pam_unix
Possible Trojan - /etc/logd/scripts/services/pluto
Possible Trojan - /etc/logd/scripts/services/portsentry
Possible Trojan - /etc/logd/scripts/services/proftpd-messages
Possible Trojan - /etc/logd/scripts/services/qmail
Possible Trojan - /etc/logd/scripts/services/raid
Possible Trojan - /etc/logd/scripts/services/rt314
Possible Trojan - /etc/logd/scripts/services/samba
Possible Trojan - /etc/logd/scripts/services/secure
Possible Trojan - /etc/logd/scripts/services/sendmail
Possible Trojan - /etc/logd/scripts/services/smartd
Possible Trojan - /etc/logd/scripts/services/sshd
Possible Trojan - /etc/logd/scripts/services/sshd2
Possible Trojan - /etc/logd/scripts/services/stunnel
Possible Trojan - /etc/logd/scripts/services/sudo
Possible Trojan - /etc/logd/scripts/services/syslogd
Possible Trojan - /etc/logd/scripts/services/tac_acc
Possible Trojan - /etc/logd/scripts/services/up2date
Possible Trojan - /etc/logd/scripts/services/vpopmail
Possible Trojan - /etc/logd/scripts/services/zz-disk_space
Possible Trojan - /etc/logd/scripts/shared/onlycontains
Possible Trojan - /etc/logd/scripts/shared/onlyhost
Possible Trojan - /etc/logd/scripts/shared/onlyservice
Possible Trojan - /etc/logd/scripts/shared/remove
Possible Trojan - /etc/logd/scripts/shared/removeheaders

[eth00]

Don't use the WHM trojan scanner, try using rkhunter. The whm one is bugged and frequently gives false positives.