Anne Wilson <cannewilson@xxxxxxxxxxxxx> wrote:
Checking `crontab'... Warning: crontab for nobody found, possible
Lupper.Worm... not infected
********
a) Lupper.Worm apparently attacks linux web servers. I don't run a web
server, on that or any other box on the lan.
b) Symptoms
Presence of one or more the following files:
* /tmp/lupii
* /tmp/listen
* /tmp/update.listen
* /tmp/listen.log
None are present
One or more of the following ports are listening/sending:
* UDP 7111
* UDP 7222
* UDP 27015
* UDP 25555
All these are reported as Stealthed by GRC.
crontab'... Warning: crontab for nobody found, possible Lupper.Worm... not
infected
The message is very puzzling. It specifically says 'not infected', and my
checks seem to agree with this.
I don't know why it talks about crontab for nobody.
cat /etc/crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=anne@xxxxxxxxxxx
HOME=/
# run-parts
1 * * * * root run-parts /etc/cron.hourly
#
2 4 * * * root run-parts /etc/cron.daily
#
22 4 * * 7 root run-parts /etc/cron.weekly
#
42 4 1 * * root run-parts /etc/cron.monthly
I've checked kcron, and while nobody is present, as indeed he is on this box
too, no tasks are set for him.
I can't see what else to check.
Anne
You should also look in /var/spool/cron. At most, you see something like:
[root@bend ~]# ls -l /var/spool/cron/
total 8
-rw------- 1 root root 39 Nov 4 09:09 root
See "man -S5 crontab" for an explanation of the file's contents.
Cheers
Dave
--
Politics, n. Strife of interests masquerading as a contest of principles.
-- Ambrose Bierce
