Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

/bin/sh: line 0: kill: (787) - No such process

Discussion in 'General Discussion' started by black&white, Sep 8, 2006.

  1. black&white

    black&white Well-Known Member

    Joined:
    Aug 10, 2004
    Messages:
    73
    Likes Received:
    0
    Trophy Points:
    156
    i am getting this email every minute.

    Does anybody know what it is?



    /bin/sh: line 0: kill: (787) - No such process

    chown root:root /tmp/py2 && chmod 4755 /tmp/py2 && rm -rf /etc/cron.d/core && kill -USR1 787


    Thank you
     
  2. mctDarren

    mctDarren Well-Known Member

    Joined:
    Jan 6, 2004
    Messages:
    664
    Likes Received:
    3
    Trophy Points:
    168
    Location:
    New Jersey
    cPanel Access Level:
    Root Administrator
    It's an exploit. You need to lock down your system! Look in /tmp and /var/tmp to start.
     
  3. black&white

    black&white Well-Known Member

    Joined:
    Aug 10, 2004
    Messages:
    73
    Likes Received:
    0
    Trophy Points:
    156
    In tmp and var/tmp everything seems ok :-/
     
  4. black&white

    black&white Well-Known Member

    Joined:
    Aug 10, 2004
    Messages:
    73
    Likes Received:
    0
    Trophy Points:
    156
    I have deleted contents of tmp folder and now i'm receiving this email contrab message:

    chown: cannot access `/tmp/py2': No such file or directory


    Please HELP!!
     
  5. blenard

    blenard Active Member

    Joined:
    Feb 19, 2004
    Messages:
    32
    Likes Received:
    0
    Trophy Points:
    156
    check your crontab
     
  6. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,460
    Likes Received:
    22
    Trophy Points:
    463
    Location:
    Go on, have a guess
    Indeed. If you have a core dump in /etc/cron.d/ or any of the other cron directories then you've most likely been root compromised and will have to have an OS restore.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. black&white

    black&white Well-Known Member

    Joined:
    Aug 10, 2004
    Messages:
    73
    Likes Received:
    0
    Trophy Points:
    156
    Done. I have deleted a file in /etc/cron.d/

    It was still there after a restore of my dedicated.

    Thank you for your help.
     
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice