Now I have this major problem (reason why I am checking cronbjobs). I am getting tons of emails regarding some eggdrop of some sort. I am not sure why because that is disabled (or should I say prevented) in WHM (checked) as running processes.

I ran cronbtab -e again and got this:


2,58 * * * * /usr/local/bandmin/bandmin
0 0 * * * /usr/local/bandmin/ipaddrmap
15 2 * * * /scripts/upcp
*/15 * * * * /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1
*/5 * * * * /usr/local/cpanel/bin/dcpumon >/dev/null 2>&1
0 6 * * * /scripts/exim_tidydb > /dev/null 2>&1


/etc/cronbtab shows this:


SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

How do I track this bad crobjob doewn exactly?

Using Fedora Core 2 i686

The next step would be to check the directories
and see whether there's anything in there
that resembles eggdrop.


Cheers,
Tink

All empty. Any other ideas? rootkit hunter was all "ok" too

Can you post one of the messages? Might help with
assessing it ...


Cheers,
Tink

I don't have any on file (the user did not reply to me with that). Anything else we can do?

Ok I got this in /var/spool/cron

gvllweb
--------

# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/gvllweb/.crontab installed on Mon Apr 19 00:06:17 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
0 * * * * http://domain.com/modules/MS_Analysi...aintenance.php

cadenza
---------
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/cadenza/.crontab installed on Wed Mar 3 22:52:11 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO="cadenza"

mailman
---------
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/usr/local/cpanel/src/3rdparty/gpl/mailman-2.1.5/cron/crontab.in installed on Sun Oct 10 18:54:09 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO=postmaster
# At 8AM every day, mail reminders to admins as to pending requests.
# They are less likely to ignore these reminders if they're mailed
# early in the morning, but of course, this is local time...
0 8 * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs
#
# At 9AM, send notifications to disabled members that are due to be
# reminded to re-enable their accounts.
0 9 * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled
#
# Noon, mail digests for lists that do periodic as well as threshhold delivery.
0 12 * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests
#
# 5 AM on the first of each month, mail out password reminders.
0 5 1 * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/mailpasswds
#
# Every 5 mins, try to gate news to mail. You can comment this one out
# if you don't want to allow gating, or don't have any going on right now,
# or want to exclusively use a callback strategy instead of polling.
#0,5,10,15,20,25,30,35,40,45,50,55 * * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/gate_news
#
# At 3:27am every night, regenerate the gzip'd archive file. Only
# turn this on if the internal archiver is used and
# GZIP_ARCHIVE_TXT_FILES is false in mm_cfg.py
27 3 * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip

nibuhaho
----------
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/nibuhaho/.crontab installed on Sat Aug 14 00:54:37 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO="nibuhaho"
0 0 * * * /home/nibuhaho/public_html/perlbill/include/auto_cron.cgi

nobody
---------

# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/usr/local/flash/psfonts/.dat//.autobotchk installed on Sat Sep 18 17:11:11 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/usr/local/flash/psfonts/.dat//.autobotchk installed on Sat Sep 18 17:11:11 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/usr/local/flash/psfonts/.dat//.autobotchk installed on Sat Sep 18 17:11:11 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (cron.d installed on Sat Sep 18 17:04:05 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
* * * * * /home/gvllweb/public_html/images/language/.psy/y2kupdate >/dev/null 2>&1
0,10,20,30,40,50 * * * * /usr/local/flash/psfonts/.dat//Fandy.botchk
0,10,20,30,40,50 * * * * /usr/local/flash/psfonts/.dat//psfonts.botchk
0,10,20,30,40,50 * * * * /usr/local/flash/psfonts/.dat//D00r.botchk

root
-----
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/scripts/.crontab installed on Sun Oct 10 20:34:03 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)

2,58 * * * * /usr/local/bandmin/bandmin
0 0 * * * /usr/local/bandmin/ipaddrmap
15 2 * * * /scripts/upcp
*/15 * * * * /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1
0 6 * * * /scripts/exim_tidydb > /dev/null 2>&1
*/5 * * * * /usr/local/cpanel/bin/dcpumon >/dev/null 2>&1

terri
-----
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/terri/.crontab installed on Fri Mar 19 08:38:43 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO=""
*/30 * * * * wget -q -O /dev/null http://domain.com/cal/tools/send_reminders.php

webhost
---------
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/webhost/.crontab installed on Wed Sep 22 12:27:42 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO="doug@webhost-galaxy.com"
0 * * * * GET http://www.domain.com/whoiscart/collector.php >/dev/null
0 3 7 * * GET http://www.domain.com/whoiscart/collector.php


What is normal and what should not be there?