LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 03-26-2005, 06:31 PM   #1
jc materi
LQ Newbie
 
Registered: Aug 2004
Location: Saskatoon, SK, Canada
Distribution: fedora 4
Posts: 25

Rep: Reputation: 15
LiveZone/y2kupdate in /var/log/messages


I have the following entry in /var/log/messages every minute:
----------------------------
Mar 26 17:19:00 <hostname> CROND[6407]: (apache) CMD (/var/tmp/sh/.LiveZone/y2kupdate >/dev/null 2>&1)
----------------------------
<hostname> substitutes for my real hostname.

Does anyone know what this is about? BTW, 'ls -la' shows /var/tmp is empty. The ls program is not comprimised according to both chkrootkit and rkhunter (latest versions freshly installed).
 
Old 03-26-2005, 08:15 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Take a look at the output of ps aux and netstat -pantu for anything abnormal especially irc (psybnc). See if you can find the executable with 'find / -name y2kupdate'.

Take a look at the entries in /etc/crontab and /etc/cron.d for anything abnormal, like:
Code:
 * * * * * /var/tmp/sh/.LiveZone/y2kupdate >/dev/null 2>&1)
As root run 'crontab -u apache -l' to display any userdefined crontabs for apache.

Anything weird in your Apache logs (errors, restarts, segfaults, etc)?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
what does messages suppressed in /var/log/messages mean saavik Linux - Networking 2 05-07-2008 03:31 PM
Redirecting the kernel messages to file other than /var/log/messages jyotika_b83 Linux - General 3 04-28-2005 07:39 PM
From where am i getting error messages to /var/log/messages? prabhuacsp Programming 3 02-16-2005 09:59 AM
From where am i getting error messages to /var/log/messages? prabhuacsp Linux - Networking 1 02-16-2005 01:34 AM
/var/log/messages full of these messages. Should I be concerned? mdavis Linux - Security 5 04-16-2004 11:08 AM


All times are GMT -5. The time now is 11:37 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration