what www perl script is running?

[Colin Brace]

Ruben de Groot wrote:
> 
> Try a find through the entire filesystem for files owned by this user that 
> you can't account for. Also check your cron and at files under /var/cron
> and
> /var/at
> 

I found the cronjob which keeps restarting the script: 

[root at venus /var/cron/tabs]# ls -l
total 12
-rw-------  1 root  wheel  3440 Aug 25 12:06 colin
-rw-------  1 root  wheel   240 Jul 28 23:49 www

[root at venus /var/cron/tabs]# cat www 
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (cron.job installed on Tue Jul 28 23:49:28 2009)
# (Cron version -- $FreeBSD: src/usr.sbin/cron/crontab/crontab.c,v 1.24
2006/09/03 17:52:19 ru Exp $)
*/1 * * * * perl /tmp/tmpfile

I removed it, so now at least the script stops relaunching.

/tmp/tmpfile is of course the script.

In a subdirectory of tmp, there is a whole bunch of source code, all owned
by 'www':

/tmp/.,]# ls -l
total 5692
-rw-r--r--  1 www  wheel  2844160 Mar 27 10:00 m.tgz
drwxr-xr-x  4 www  wheel      512 Nov 10  2008 ml
-rw-r--r--  1 www  wheel    43419 May 27 23:22 scanxml.txt

]# ls -l ml
total 3208
-rwxr-xr-x  1 www  wheel     411 Mar 27 09:57 1.user
-rwxr-xr-x  1 www  wheel     422 Mar 27 09:57 2.user
-rwxr-xr-x  1 www  wheel  505767 Aug  3  2008 LinkEvents
-rwxr-xr-x  1 www  wheel    2154 May 16  2003 Makefile
-rwx--x--x  1 www  wheel  418490 Dec  3  2005 bsd
-rwxr-xr-x  1 www  wheel     941 Dec  3  2005 checkmech
-rwxr-xr-x  1 www  wheel   23237 May 16  2003 configure
-rwx--x--x  1 www  wheel  397274 Dec  3  2005 crond
-rwxr-xr-x  1 www  wheel   22882 May 16  2003 m.h
-rwxr-xr-x  1 www  wheel    1054 Aug  3  2008 m.lev
-rwx--x--x  1 www  wheel       6 May 25  2008 m.pid
-rwxr-xr-x  1 www  wheel    1320 Mar 27 09:56 m.set
-rwxr-xr-x  1 www  wheel   10240 Nov 10  2008 m.tgz
-rwxr-xr-x  1 www  wheel  167964 Mar 16  2001 pico
drwxr-xr-x  2 www  wheel     512 Mar  4  2005 r
drwxr-xr-x  2 www  wheel    1024 Dec  3  2005 src

If anyone is interested in looking at this stuff, or wants more info, please
let me know.

-----
  Colin Brace
  Amsterdam
  http://lim.nl
-- 
View this message in context: http://www.nabble.com/what-www-perl-script-is-running--tp25112050p25135959.html
Sent from the freebsd-questions mailing list archive at Nabble.com.