I have previously asked a question There's an expect.php file in all the git repositories of my web server, is this malicious? and this question is a further continuation if it.

After investigating some more, I found in my cPanel processes section the following processes:

Screenshot of Processes

The reason I am skeptical regarding the processes is that when I delete the malicious expect.php or options.php files I have asked about in my previous question, they automatically come back in about a minute or two. To my tiny brain, this suggests that something is running as a background process behind all this misery.

So my question this time is, are these processes malicious or things that are run by cPanel or HostGator's PHP shared hosting servers by default? Please do note that none of the PHP apps I have written have any "processes" in them. So I suspect that this could either be a part of the malware or something that is run by HostGator or cPanel.

  • We are a security Q&A site; not on hire consultants to analyze your situation. Repeated questions about a incident you face are not a good fit for this site. What's normal and not normal is nor easy to tell without knowledge of your situation. Hire a security professional who's able to have hands on look at your situation.
    – vidarlo
    Nov 12, 2022 at 14:34
  • @vidarlo Alright, thanks, my bad. Nov 12, 2022 at 14:57


Browse other questions tagged .