RE: [cobalt-security] CROND

["Jamie - i-Dot" <jamie@xxxxxxxxx>]

Try locate CROND

Or a similar find,

You could also try netstat  to see what port its running on / any
unusual external ports open.

Do you have a crond AND a CROND ?

Could it be a cron process which has spawned, but not exited? 
 
-----Original Message-----
From: cobalt-security-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-security-admin@xxxxxxxxxxxxxxx] On Behalf Of Skyhound
Internet
Sent: 26 November 2002 22:12
To: cobalt-security@xxxxxxxxxxxxxxx

I have a process running on one of my Raq4's called CROND.  Not to be
mistaken with crond.

root      4180  0.0  0.1  1156  536 ?        S    14:09   0:00 CROND

I am unaware of what this process is. The latest chkrootkit shows no
hacks.

A reboot of the machine cleared it out but it came back again the next
day.

Any ideas of what this might be?

Thanks

Tom

_______________________________________
Skyhound Internet
Long Beach CA

_______________________________________________
cobalt-security mailing list
cobalt-security@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-security