files executed via apache

td3201 · 09-02-2010, 02:17 PM

Hello,

I have an older shared web server that I found a running process on as apache that simply attempted to open a socket on 6969. The path was like:
/usr/sbin/httpd/loggs

The actual file didn't exist. I am confident it came through a site but I am more curious what settings in apache affect the ability to do this?

Thanks!

14moose · 09-02-2010, 02:29 PM

Your /etc/httpd.conf (Apache configuration) file is the first place I'd look.

Port 6969 is typically used for BitTorrent. I'd look around for some .torrent files, or a BT "settings.dat" configuration file.

td3201 · 09-02-2010, 02:30 PM

Really?