Forum Archive - Firewall Detect Suspicious Process from Gtranslate

I receive mail notification from my server like below: Time: Wed Oct 9 08:27:47 2013 +0800 PID: 14522 (Parent PID:13015) Account: myaccount Uptime: 86 seconds Executable: /usr/bin/php Command Line (often faked in exploits): /usr/bin/php /home/myaccount/public_html/gtranslate/translate.php Network connections by the process (if any): tcp: my.server.ip:42667 -> 74.125.224.137:80 Files open by the process (if any): /tmp/session_mm_cgi-fcgi502.sem (deleted) Memory maps by the process (if any): 00400000-00b55000 r-xp 00000000 fd:00 35771618 /usr/bin/php 00d55000-00dda000 rw-p 00755000 fd:00 35771618 /usr/bin/php 00dda000-00dfc000 rw-p 00dda000 00:00 0 02b40000-0339a000 rw-p 02b40000 00:00 0 [heap] 315c600000-315c7d1000 r-xp 00000000 fd:00 35760250 /usr/lib64/libmysqlclient.so.16.0.0 315c7d1000-315c9d1000 ---p 001d1000 fd:00 35760250 /usr/lib64/libmysqlclient.so.16.0.0 315c9d1000-315ca23000 rw-p 001d1000 fd:00 35760250 /usr/lib64/libmysqlclient.so.16.0.0 315ca23000-315ca24000 rw-p 315ca23000 00:00 0 34bcc00000-34bcc06000 r-xp 00000000 fd:00 35764875 /usr/lib64/libltdl.so.3.1.4 34bcc06000-34bce06000 ---p 00006000 fd:00 35764875 /usr/lib64/libltdl.so.3.1.4 34bce06000-34bce07000 rw-p 00006000 fd:00 35764875 /usr/lib64/libltdl.so.3.1.4 3ac4600000-3ac461c000 r-xp 00000000 fd:00 64749581 /lib64/ld-2.5.so 3ac481c000-3ac481d000 r--p 0001c000 fd:00 64749581 /lib64/ld-2.5.so 3ac481d000-3ac481e000 rw-p 0001d000 fd:00 64749581 /lib64/ld-2.5.so 3ac4a00000-3ac4b4f000 r-xp 00000000 fd:00 64749593 /lib64/libc-2.5.so 3ac4b4f000-3ac4d4e000 ---p 0014f000 fd:00 64749593 /lib64/libc-2.5.so 3ac4d4e000-3ac4d52000 r--p 0014e000 fd:00 64749593 /lib64/libc-2.5.so 3ac4d52000-3ac4d53000 rw-p 00152000 fd:00 64749593 /lib64/libc-2.5.so 3ac4d53000-3ac4d58000 rw-p 3ac4d53000 00:00 0 3ac4e00000-3ac4e02000 r-xp 00000000 fd:00 64749609 /lib64/libdl-2.5.so 3ac4e02000-3ac5002000 ---p 00002000 fd:00 64749609 /lib64/libdl-2.5.so 3ac5002000-3ac5003000 r--p 00002000 fd:00 64749609 /lib64/libdl-2.5.so 3ac5003000-3ac5004000 rw-p 00003000 fd:00 64749609 /lib64/libdl-2.5.so 3ac5200000-3ac5216000 r-xp 00000000 fd:00 64749965 /lib64/libpthread-2.5.so 3ac5216000-3ac5416000 ---p 00016000 fd:00 64749965 /lib64/libpthread-2.5.so 3ac5416000-3ac5417000 r--p 00016000 fd:00 64749965 /lib64/libpthread-2.5.so 3ac5417000-3ac5418000 rw-p 00017000 fd:00 64749965 /lib64/libpthread-2.5.so 3ac5418000-3ac541c000 rw-p 3ac5418000 00:00 0 3ac5600000-3ac5682000 r-xp 00000000 fd:00 64749631 /lib64/libm-2.5.so 3ac5682000-3ac5881000 ---p 00082000 fd:00 64749631 /lib64/libm-2.5.so 3ac5881000-3ac5882000 r--p 00081000 fd:00 64749631 /lib64/libm-2.5.so 3ac5882000-3ac5883000 rw-p 00082000 fd:00 64749631 /lib64/libm-2.5.so 3ac5a00000-3ac5a14000 r-xp 00000000 fd:00 64749813 /lib64/libz.so.1.2.3 3ac5a14000-3ac5c13000 ---p 00014000 fd:00 64749813 /lib64/libz.so.1.2.3 3ac5c13000-3ac5c14000 rw-p 00013000 fd:00 64749813 /lib64/libz.so.1.2.3 3ac5e00000-3ac5e15000 r-xp 00000000 fd:00 64749970 /lib64/libselinux.so.1 3ac5e15000-3ac6015000 ---p 00015000 fd:00 64749970 /lib64/libselinux.so.1 3ac6015000-3ac6017000 rw-p 00015000 fd:00 64749970 /lib64/libselinux.so.1 3ac6017000-3ac6018000 rw-p 3ac6017000 00:00 0 3ac6200000-3ac623b000 r-xp 00000000 fd:00 64749969 /lib64/libsepol.so.1 3ac623b000-3ac643b000 ---p 0003b000 fd:00 64749969 /lib64/libsepol.so.1 3ac643b000-3ac643c000 rw-p 0003b000 fd:00 64749969 /lib64/libsepol.so.1 3ac643c000-3ac6446000 rw-p 3ac643c000 00:00 0 3ac6600000-3ac6607000 r-xp 00000000 fd:00 64749625 /lib64/librt-2.5.so 3ac6607000-3ac6807000 ---p 00007000 fd:00 64749625 /lib64/librt-2.5.so 3ac6807000-3ac6808000 r--p 00007000 fd:00 64749625 /lib64/librt-2.5.so 3ac6808000-3ac6809000 rw-p 00008000 fd:00 64749625 /lib64/librt-2.5.so 3ac6a00000-3ac6a15000 r-xp 00000000 fd:00 64749966 /lib64/libnsl-2.5.so 3ac6a15000-3ac6c14000 ---p 00015000 fd:00 64749966 /lib64/libnsl-2.5.so 3ac6c14000-3ac6c15000 r--p 00014000 fd:00 64749966 /lib64/libnsl-2.5.so 3ac6c15000-3ac6c16000 rw-p 00015000 fd:00 64749966 /lib64/libnsl-2.5.so 3ac6c16000-3ac6c18000 rw-p 3ac6c16000 00:00 0 3ac6e00000-3ac6e09000 r-xp 00000000 fd:00 64749975 /lib64/libcrypt-2.5.so 3ac6e09000-3ac7008000 ---p 00009000 fd:00 64749975 /lib64/libcrypt-2.5.so 3ac7008000-3ac7009000 r--p 00008000 fd:00 64749975 /lib64/libcrypt-2.5.so 3ac7009000-3ac700a000 rw-p 00009000 fd:00 64749975 /lib64/libcrypt-2.5.so 3ac700a000-3ac7038000 rw-p 3ac700a000 00:00 0 3ac7200000-3ac7210000 r-xp 00000000 fd:00 35763941 /usr/lib64/libXpm.so.4.11.0 3ac7210000-3ac7410000 ---p 00010000 fd:00 35763941 /usr/lib64/libXpm.so.4.11.0 3ac7410000-3ac7411000 rw-p 00010000 fd:00 35763941 /usr/lib64/libXpm.so.4.11.0 3ac7a00000-3ac7b2d000 r-xp 00000000 fd:00 64749972 /lib64/libcrypto.so.0.9.8e 3ac7b2d000-3ac7d2c000 ---p 0012d000 fd:00 64749972 /lib64/libcrypto.so.0.9.8e 3ac7d2c000-3ac7d4d000 rw-p 0012c000 fd:00 64749972 /lib64/libcrypto.so.0.9.8e 3ac7d4d000-3ac7d51000 rw-p 3ac7d4d000 00:00 0 3ac7e00000-3ac7e11000 r-xp 00000000 fd:00 64749968 /lib64/libresolv-2.5.so 3ac7e11000-3ac8011000 ---p 00011000 fd:00 64749968 /lib64/libresolv-2.5.so 3ac8011000-3ac8012000 r--p 00011000 fd:00 64749968 /lib64/libresolv-2.5.so 3ac8012000-3ac8013000 rw-p 00012000 fd:00 64749968 /lib64/libresolv-2.5.so 3ac8013000-3ac8015000 rw-p 3ac8013000 00:00 0 3ac8200000-3ac8221000 r-xp 00000000 fd:00 35751195 /usr/lib64/libjpeg.so.62.0.0 3ac8221000-3ac8420000 ---p 00021000 fd:00 35751195 /usr/lib64/libjpeg.so.62.0.0 3ac8420000-3ac8421000 rw-p 00020000 fd:00 35751195 /usr/lib64/libjpeg.so.62.0.0 3ac8a00000-3ac8a7f000 r-xp 00000000 fd:00 35765238 /usr/lib64/libfreetype.so.6.3.10 3ac8a7f000-3ac8c7f000 ---p 0007f000 fd:00 35765238 /usr/lib64/libfreetype.so.6.3.10 3ac8c7f000-3ac8c84000 rw-p 0007f000 fd:00 35765238 /usr/lib64/libfreetype.so.6.3.10 3ac8e00000-3ac8e17000 r-xp 00000000 fd:00 64749612 /lib64/libaudit.so.0.0.0 3ac8e17000-3ac9016000 ---p 00017000 fd:00 64749612 /lib64/libaudit.so.0.0.0 3ac9016000-3ac9018000 rw-p 00016000 fd:00 64749612 /lib64/libaudit.so.0.0.0 3ac9200000-3ac9305000 r-xp 00000000 fd:00 35771679 /usr/lib64/libX11.so.6.2.0 3ac9305000-3ac9505000 ---p 00105000 fd:00 35771679 /usr/lib64/libX11.so.6.2.0 3ac9505000-3ac950c000 rw-p 00105000 fd:00 35771679 /usr/lib64/libX11.so.6.2.0 3ac9600000-3ac9602000 r-xp 00000000 fd:00 64749967 /lib64/libkeyutils-1.2.so 3ac9602000-3ac9801000 ---p 00002000 fd:00 64749967 /lib64/libkeyutils-1.2.so 3ac9801000-3ac9802000 rw-p 00001000 fd:00 64749967 /lib64/libkeyutils-1.2.so 3ac9a00000-3ac9a02000 r-xp 00000000 fd:00 64749971 /lib64/libcom_err.so.2.1 3ac9a02000-3ac9c01000 ---p 00002000 fd:00 64749971 /lib64/libcom_err.so.2.1 3ac9c01000-3ac9c02000 rw-p 00001000 fd:00 64749971 /lib64/libcom_err.so.2.1 3ac9e00000-3ac9e31000 r-xp 00000000 fd:00 35762850 /usr/lib64/libidn.so.11.5.19 3ac9e31000-3aca030000 ---p 00031000 fd:00 35762850 /usr/lib64/libidn.so.11.5.19 3aca030000-3aca031000 rw-p 00030000 fd:00 35762850 /usr/lib64/libidn.so.11.5.19 3acb200000-3acb20b000 r-xp 00000000 fd:00 64749614 /lib64/libpam.so.0.81.5 3acb20b000-3acb40a000 ---p 0000b000 fd:00 64749614 /lib64/libpam.so.0.81.5 3acb40a000-3acb40b000 rw-p 0000a000 fd:00 64749614 /lib64/libpam.so.0.81.5 3acb600000-3acb605000 r-xp 00000000 fd:00 35771592 /usr/lib64/libXdmcp.so.6.0.0 3acb605000-3acb804000 ---p 00005000 fd:00 35771592 /usr/lib64/libXdmcp.so.6.0.0 3acb804000-3acb805000 rw-p 00004000 fd:00 35771592 /usr/lib64/libXdmcp.so.6.0.0 3acba00000-3acba23000 r-xp 00000000 fd:00 35771689 /usr/lib64/libpng12.so.0.10.0 3acba23000-3acbc23000 ---p 00023000 fd:00 35771689 /usr/lib64/libpng12.so.0.10.0 3acbc23000-3acbc24000 rw-p 00023000 fd:00 35771689 /usr/lib64/libpng12.so.0.10.0 3acc600000-3acc602000 r-xp 00000000 fd:00 35766554 /usr/lib64/libXau.so.6.0.0 3acc602000-3acc801000 ---p 00002000 fd:00 35766554 /usr/lib64/libXau.so.6.0.0 3acc801000-3acc802000 rw-p 00001000 fd:00 35766554 /usr/lib64/libXau.so.6.0.0 3eaee00000-3eaee24000 r-xp 00000000 fd:00 35759523 /usr/lib64/libk5crypto.so.3.1 3eaee24000-3eaf023000 ---p 00024000 fd:00 35759523 /usr/lib64/libk5crypto.so.3.1 3eaf023000-3eaf025000 rw-p 00023000 fd:00 35759523 /usr/lib64/libk5crypto.so.3.1 3eaf200000-3eaf208000 r-xp 00000000 fd:00 35765377 /usr/lib64/libkrb5support.so.0.1 3eaf208000-3eaf407000 ---p 00008000 fd:00 35765377 /usr/lib64/libkrb5support.so.0.1 3eaf407000-3eaf408000 rw-p 00007000 fd:00 35765377 /usr/lib64/libkrb5support.so.0.1 3eaf600000-3eaf691000 r-xp 00000000 fd:00 35759511 /usr/lib64/libkrb5.so.3.3 3eaf691000-3eaf891000 ---p 00091000 fd:00 35759511 /usr/lib64/libkrb5.so.3.3 3eaf891000-3eaf895000 rw-p 00091000 fd:00 35759511 /usr/lib64/libkrb5.so.3.3 3eafa00000-3eafa2c000 r-xp 00000000 fd:00 35759521 /usr/lib64/libgssapi_krb5.so.2.2 3eafa2c000-3eafc2c000 ---p 0002c000 fd:00 35759521 /usr/lib64/libgssapi_krb5.so.2.2 3eafc2c000-3eafc2e000 rw-p 0002c000 fd:00 35759521 /usr/lib64/libgssapi_krb5.so.2.2 3eafe00000-3eafe48000 r-xp 00000000 fd:00 64749591 /lib64/libssl.so.0.9.8e 3eafe48000-3eb0048000 ---p 00048000 fd:00 64749591 /lib64/libssl.so.0.9.8e 3eb0048000-3eb004e000 rw-p 00048000 fd:00 64749591 /lib64/libssl.so.0.9.8e 2ad82c826000-2ad82c828000 rw-p 2ad82c826000 00:00 0 2ad82c837000-2ad82c838000 rw-p 2ad82c837000 00:00 0 2ad82c838000-2ad82c84a000 r-xp 00000000 fd:00 28705495 /opt/xslt/lib/libexslt.so.0.8.16 2ad82c84a000-2ad82ca49000 ---p 00012000 fd:00 28705495 /opt/xslt/lib/libexslt.so.0.8.16 2ad82ca49000-2ad82ca4a000 rw-p 00011000 fd:00 28705495 /opt/xslt/lib/libexslt.so.0.8.16 2ad82ca4a000-2ad82ca4b000 rw-p 2ad82ca4a000 00:00 0 2ad82ca4b000-2ad82ca9e000 r-xp 00000000 fd:00 28705406 /opt/tidy/lib/libtidy-0.99.so.0.0.0 2ad82ca9e000-2ad82cc9e000 ---p 00053000 fd:00 28705406 /opt/tidy/lib/libtidy-0.99.so.0.0.0 2ad82cc9e000-2ad82cca7000 rw-p 00053000 fd:00 28705406 /opt/tidy/lib/libtidy-0.99.so.0.0.0 2ad82cca7000-2ad82cca8000 rw-p 2ad82cca7000 00:00 0 2ad82cca8000-2ad82ccd0000 r-xp 00000000 fd:00 28745550 /opt/libmcrypt/lib/libmcrypt.so.4.4.8 2ad82ccd0000-2ad82ced0000 ---p 00028000 fd:00 28745550 /opt/libmcrypt/lib/libmcrypt.so.4.4.8 2ad82ced0000-2ad82ced3000 rw-p 00028000 fd:00 28745550 /opt/libmcrypt/lib/libmcrypt.so.4.4.8 2ad82ced3000-2ad82cedc000 rw-p 2ad82ced3000 00:00 0 2ad82cedc000-2ad82cf17000 r-xp 00000000 fd:00 28704772 /opt/pcre/lib/libpcre.so.0.0.1 2ad82cf17000-2ad82d117000 ---p 0003b000 fd:00 28704772 /opt/pcre/lib/libpcre.so.0.0.1 2ad82d117000-2ad82d118000 rw-p 0003b000 fd:00 28704772 /opt/pcre/lib/libpcre.so.0.0.1 2ad82d118000-2ad82d11a000 rw-p 2ad82d118000 00:00 0 2ad82d11a000-2ad82d16f000 r-xp 00000000 fd:00 28704909 /opt/curlssl/lib/libcurl.so.4.2.0 2ad82d16f000-2ad82d36f000 ---p 00055000 fd:00 28704909 /opt/curlssl/lib/libcurl.so.4.2.0 2ad82d36f000-2ad82d372000 rw-p 00055000 fd:00 28704909 /opt/curlssl/lib/libcurl.so.4.2.0 2ad82d372000-2ad82d373000 rw-p 2ad82d372000 00:00 0 2ad82d373000-2ad82d3ac000 r-xp 00000000 fd:00 28705462 /opt/xslt/lib/libxslt.so.1.1.27 2ad82d3ac000-2ad82d5ab000 ---p 00039000 fd:00 28705462 /opt/xslt/lib/libxslt.so.1.1.27 2ad82d5ab000-2ad82d5ad000 rw-p 00038000 fd:00 28705462 /opt/xslt/lib/libxslt.so.1.1.27 2ad82d5ad000-2ad82d6ee000 r-xp 00000000 fd:00 28705123 /opt/xml2/lib/libxml2.so.2.9.0 2ad82d6ee000-2ad82d8ed000 ---p 00141000 fd:00 28705123 /opt/xml2/lib/libxml2.so.2.9.0 2ad82d8ed000-2ad82d8f7000 rw-p 00140000 fd:00 28705123 /opt/xml2/lib/libxml2.so.2.9.0 2ad82d8f7000-2ad82d900000 rw-p 2ad82d8f7000 00:00 0 2ad82d941000-2ad82d990000 rw-p 2ad82d941000 00:00 0 2ad82d990000-2ad82da7f000 r-xp 00000000 fd:00 37912587 /usr/local/IonCube/ioncube_loader_lin_5.3.so 2ad82da7f000-2ad82db7e000 ---p 000ef000 fd:00 37912587 /usr/local/IonCube/ioncube_loader_lin_5.3.so 2ad82db7e000-2ad82db8d000 rw-p 000ee000 fd:00 37912587 /usr/local/IonCube/ioncube_loader_lin_5.3.so 2ad82db8d000-2ad82db91000 rw-p 2ad82db8d000 00:00 0 2ad82db91000-2ad82dc7c000 r-xp 00000000 fd:00 37814365 /usr/local/Zend/lib/Guard-5.5.0/php-5.3.x/ZendGuardLoader.so 2ad82dc7c000-2ad82dd7c000 ---p 000eb000 fd:00 37814365 /usr/local/Zend/lib/Guard-5.5.0/php-5.3.x/ZendGuardLoader.so 2ad82dd7c000-2ad82dd99000 rw-p 000eb000 fd:00 37814365 /usr/local/Zend/lib/Guard-5.5.0/php-5.3.x/ZendGuardLoader.so 2ad82dd99000-2ad82dd9d000 rw-p 2ad82dd99000 00:00 0 2ad82dd9d000-2ad82ddbb000 r-xp 00000000 fd:00 37486999 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/suhosin.so 2ad82ddbb000-2ad82dfba000 ---p 0001e000 fd:00 37486999 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/suhosin.so 2ad82dfba000-2ad82dfc0000 rw-p 0001d000 fd:00 37486999 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/suhosin.so 2ad82dfc0000-2ad82dfc2000 rw-p 2ad82dfc0000 00:00 0 2ad82dfc2000-2ad82dfd8000 r-xp 00000000 fd:00 37486997 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo.so 2ad82dfd8000-2ad82e1d7000 ---p 00016000 fd:00 37486997 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo.so 2ad82e1d7000-2ad82e1da000 rw-p 00015000 fd:00 37486997 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo.so 2ad82e1da000-2ad82e266000 r-xp 00000000 fd:00 37488079 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_sqlite.so 2ad82e266000-2ad82e465000 ---p 0008c000 fd:00 37488079 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_sqlite.so 2ad82e465000-2ad82e469000 rw-p 0008b000 fd:00 37488079 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_sqlite.so 2ad82e469000-2ad82e4b6000 r-xp 00000000 fd:00 37488080 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/sqlite.so 2ad82e4b6000-2ad82e6b5000 ---p 0004d000 fd:00 37488080 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/sqlite.so 2ad82e6b5000-2ad82e6bb000 rw-p 0004c000 fd:00 37488080 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/sqlite.so 2ad82e6bb000-2ad82e6cd000 r-xp 00000000 fd:00 37486995 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/zip.so 2ad82e6cd000-2ad82e8cc000 ---p 00012000 fd:00 37486995 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/zip.so 2ad82e8cc000-2ad82e8ce000 rw-p 00011000 fd:00 37486995 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/zip.so 2ad82e8ce000-2ad82e8d5000 r-xp 00000000 fd:00 37488078 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_mysql.so 2ad82e8d5000-2ad82ead4000 ---p 00007000 fd:00 37488078 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_mysql.so 2ad82ead4000-2ad82ead5000 rw-p 00006000 fd:00 37488078 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/pdo_mysql.so 2ad82ead5000-2ad832ad5000 rw-s 00000000 00:09 2054553605 /SYSV00000000 (deleted) 2ad832ae4000-2ad832aee000 r-xp 00000000 fd:00 64749641 /lib64/libnss_files-2.5.so 2ad832aee000-2ad832ced000 ---p 0000a000 fd:00 64749641 /lib64/libnss_files-2.5.so 2ad832ced000-2ad832cee000 r--p 00009000 fd:00 64749641 /lib64/libnss_files-2.5.so 2ad832cee000-2ad832cef000 rw-p 0000a000 fd:00 64749641 /lib64/libnss_files-2.5.so 2ad832cef000-2ad832d70000 rw-p 2ad832cef000 00:00 0 2ad832d7f000-2ad832d83000 r-xp 00000000 fd:00 64749590 /lib64/libnss_dns-2.5.so 2ad832d83000-2ad832f82000 ---p 00004000 fd:00 64749590 /lib64/libnss_dns-2.5.so 2ad832f82000-2ad832f83000 r--p 00003000 fd:00 64749590 /lib64/libnss_dns-2.5.so 2ad832f83000-2ad832f84000 rw-p 00004000 fd:00 64749590 /lib64/libnss_dns-2.5.so 7fff42719000-7fff4272d000 rwxp 7ffffffe9000 00:00 0 [stack] 7fff4272d000-7fff4272e000 rw-p 7fffffffe000 00:00 0 7fff427fd000-7fff42800000 r-xp 7fff427fd000 00:00 0 [vdso] ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vsyscall]

Hi, Please contact with that info to your hosting provider and ask for explanation.

They said nothing suspicious at this time. Your script is connecting to another server for data processing. IP is google IP.

Is this a normal behavior from /gtranslate/translate.php?

Yes, it is OK.