Strange apache error code line. sh: line 1: /bin/whoami: No such file or directory

[Chaze]

sh: line 1: /bin/whoami: No such file or directory
sh: line 1: /bin/whoami: No such file or directory

I have this over and over.

It's not a shared server so I guess it's from a script some how.

I also found this one:

[Tue Oct 11 22:59:53 2005] [error] System: Connection reset by peer (errno: 104)

Strange stuff.

Thanks for any ideas.

DJ

[chirpy]

So, are you seeing those in the apache error_log? If so, then most commonly from what I've seen, script exploits run whoami to establish the user credentials that they've gained access with after using an vulnerability in a script.