Cron user apache?

[snaaps]

Helle, i found this rule in de logfiles:
Jan 28 22:20:01 serv1 crond[26422]: (apache) CMD (/var/tmp/awyeah/y2kupdate >/dev/null 2>&1)

All this directorys and file do not exits
(i checkt locate y2kupdate etc, etc)

But the cron will go on, where can i delete this cron?

 

[genocide]

I've the same think in the crontab ... i think it's a irc bot.

So, u're machine it's comprimise ...

This command help u to locate the folder of the bot ...

find / -name *y2kupdate*


This is the list of crontab of apache user

crontab -u apache -l

With this command u can remove all crontab for apache user.

crontab -u apache -r

This command must be exec from root account.

See u