The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

/bin/sh: line 0: kill: (787) - No such process

Discussion in 'General Discussion' started by black&white, Sep 8, 2006.

  1. black&white

    black&white Well-Known Member

    Joined:
    Aug 10, 2004
    Messages:
    73
    Likes Received:
    0
    Trophy Points:
    0
    i am getting this email every minute.

    Does anybody know what it is?



    /bin/sh: line 0: kill: (787) - No such process

    chown root:root /tmp/py2 && chmod 4755 /tmp/py2 && rm -rf /etc/cron.d/core && kill -USR1 787


    Thank you
     
  2. mctDarren

    mctDarren Well-Known Member

    Joined:
    Jan 6, 2004
    Messages:
    664
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    New Jersey
    cPanel Access Level:
    Root Administrator
    It's an exploit. You need to lock down your system! Look in /tmp and /var/tmp to start.
     
  3. black&white

    black&white Well-Known Member

    Joined:
    Aug 10, 2004
    Messages:
    73
    Likes Received:
    0
    Trophy Points:
    0
    In tmp and var/tmp everything seems ok :-/
     
  4. black&white

    black&white Well-Known Member

    Joined:
    Aug 10, 2004
    Messages:
    73
    Likes Received:
    0
    Trophy Points:
    0
    I have deleted contents of tmp folder and now i'm receiving this email contrab message:

    chown: cannot access `/tmp/py2': No such file or directory


    Please HELP!!
     
  5. blenard

    blenard Active Member

    Joined:
    Feb 19, 2004
    Messages:
    32
    Likes Received:
    0
    Trophy Points:
    6
    check your crontab
     
  6. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Indeed. If you have a core dump in /etc/cron.d/ or any of the other cron directories then you've most likely been root compromised and will have to have an OS restore.
     
  7. black&white

    black&white Well-Known Member

    Joined:
    Aug 10, 2004
    Messages:
    73
    Likes Received:
    0
    Trophy Points:
    0
    Done. I have deleted a file in /etc/cron.d/

    It was still there after a restore of my dedicated.

    Thank you for your help.
     
Loading...

Share This Page