Do somebody had this situation where an Email is sent every minutes to a specific user named michel. These emails are incoming from: Root with an header like: Cron michel@donais ~/.h5siP >/dev/null 2>/dev/null; and a text message as: /bin/sh: no: command not found
There is a cron task named h5siP in the path of this user; he is the only one affected by this situation. I found that this script have a relation with an other one named as R5Agz
If I remove the cron job h5siP from the cron listing and I restart cron the script is back a few minutes later. .h5siP-p and .R5Agz-p are located in dev/shm/ and both contain a process number as 23374 and 35678 .R5Agz and .h5siP can be found in a user named michel repertory wich the one who receive a lot of emails .h5siP is also located in /temp
The only changes we made to our system was yesterday. We made an automatic yum updte of three programs ; java 1.6. kpartx and device-mapper-multipath. I don't know if there is a relation or do I face a kind of virus?
I hope somebody can help
---
Michel Donais