/bin/sh: line 0: kill: (787) - No such process

[black&white]

i am getting this email every minute.

Does anybody know what it is?



/bin/sh: line 0: kill: (787) - No such process

chown root:root /tmp/py2 && chmod 4755 /tmp/py2 && rm -rf /etc/cron.d/core && kill -USR1 787


Thank you

 

[mctDarren]

It's an exploit. You need to lock down your system! Look in /tmp and /var/tmp to start.

 

[black&white]

In tmp and var/tmp everything seems ok :-/

 

[black&white]

I have deleted contents of tmp folder and now i'm receiving this email contrab message:

chown: cannot access `/tmp/py2': No such file or directory


Please HELP!!

 

[blenard]

check your crontab

 

[chirpy]

Indeed. If you have a core dump in /etc/cron.d/ or any of the other cron directories then you've most likely been root compromised and will have to have an OS restore.

 

[black&white]

Done. I have deleted a file in /etc/cron.d/

It was still there after a restore of my dedicated.

Thank you for your help.