The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

problem with crons

Discussion in 'General Discussion' started by cwboaze, Jan 20, 2007.

  1. cwboaze

    cwboaze Member

    Joined:
    Nov 5, 2005
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    1
    HI all,

    I have a really pain
    of a problem happening and
    I cannot seem to find out where
    it is to get rid of it.

    ok, here is my situation.

    I get an email every seems like
    minute or two, with the following in it:

    Subject:

    "
    Cron <root@host> chown root:root /home/denisemi/public_html/mailer/attach/solpot && chmod 4755 /home/denisemi/public_html/mailer/attach/solpot && rm -rf /etc/cron.d/core && kill -USR1 22569
    "

    Body:

    "
    /bin/sh: line 0: kill: (22569) - No such process
    "

    this thing is running on and on.

    ok, I got rid of a file located, like this:
    which I hope was the right thing to do:

    I ran this:

    Code:
    mv /etc/cron.deny /etc/cron.allow
    and it done ok!,

    I had a file located: /etc/cron.deny file with nobody listed in it

    So I ran the above.

    ok, great.

    also: to note, i run crontab -e
    and it lists all crons avaialable and it is not listed.
    How do I find this cron and get rid of it.
    I don't know the find command to find a certain line of
    text inside of all documents.

    or any advice would be appreciated.

    Thanks,
    Chris B
     
    #1 cwboaze, Jan 20, 2007
    Last edited: Jan 20, 2007
  2. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    That's a root exploit. If it's been successful, then you've had a root compromise and need to have an OS reload done with a supported OS and the latest kernel for the OS plus have the box secured.
     
  3. cwboaze

    cwboaze Member

    Joined:
    Nov 5, 2005
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    1
    you know, I figured that was the problem.

    man!, that sucks.

    oh well, what can you do!

    Thanks for your help!
    and advice.
     
Loading...

Share This Page