[Database Update] cron problem

Home Page Forums Network Management ZeroShell [Database Update] cron problem

This topic contains 0 replies, has 0 voices, and was last updated by  simondosmith 5 years, 7 months ago.

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • #43764

    simondosmith
    Member

    Hi,

    hopying someone can help me with this very puzzling problem?

    randomly on monday one of our sites using zeroshell started seeing SLOW dns requests and internet, we checked with ISP, no problems so check router

    we looked into our zeroshell router and we noticed that named was using neally 40% CPU usage!? and also ldapd was also using neally 40% usage

    when loading a page it would take about a min or 2 to look for the ip of a dns name then spring into life!

    we also noticed on our SYSLOG server that we was getting
    ‘ [Cron Database]: Running … ‘ repeating every 2 minutes ???
    coming from our zeroshell router and we managed to trace it bk to the Cron Database script and the line
    ‘ /DB/.DB.001 ‘

    if we # out that line, the server resumes to normal usage and everything speeds up but take out the # and it starts playing funny again 🙁

    we also noticed that all of our logs from previous months on the zeroshell had vanished too!, thankfully we had the syslog stuff on our servers

    round about the time this Cron Database started showing up i noticed this in our syslogs
    ‘ (root) REPLACE (root) ‘ and ‘ (CRON) STARTUP (V5.0) ‘

    have we possible come under attack by a hacker maybe and hes gained access?
    is it as simple as zeroshell have changed something and the zeroshell doesnt like it?

    any suggestions would be much helpful 🙂

    regards

    Simon

    #52978

    fsala
    Member

    Hi, I found out that there is a MALWARE around… and

    Have a look at my post on the italian forum (sorry, it’s in italian, but you should be able to find your way on the code…): http://www.zeroshell.net/forum/viewtopic.php?t=4115

    UPDATE
    Same post in english: https://www.zeroshell.org/forum/viewtopic.php?t=4176

Viewing 2 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.