Trying to clean up a wordpress install that’s been hacked and causing me headaches, think I’ve scrubbed it of nasty scripts…
but tailing syslog I see:
Jan 25 06:28:01 lester CRON[26721]: (git) CMD (/tmp/lib/y >/dev/null 2>&1)
Jan 25 14:58:01 lester CRON[26722]: (git) CMD (/tmp/lib/y >/dev/null 2>&1)
Jan 25 14:59:01 lester CRON[26787]: (git) CMD (/tmp/lib/y >/dev/null 2>&1)
Jan 21 13:37:01 lester CRON[26905]: (www-data) CMD (/var/www/mysite/public/wp-admin/meta/1.sh)
Jan 25 15:01:01 lester CRON[26906]: (git) CMD (/tmp/lib/y >/dev/null 2>&1)
I’m confused by this, how is a log entry from jan 21 ending up here with jan 25 entries when I’m tail -f‘ing syslog?
Also, there is no crontab for the www-data and no file /var/www/mysite/public/wp-admin/meta/1.sh
