Subject: Re: system possibly compromised
To: Andy R <quadreverb@yahoo.com>
From: Dave Huang <khym@azeotrope.org>
List: netbsd-help
Date: 02/24/2004 16:48:48
On Tue, Feb 24, 2004 at 01:51:26PM -0800, Andy R wrote:
> --- Roger Fischer <rgfisch@excite.com> wrote:
> >     13252   296   296 9a1f80    0 I    ??   0:00.01
> > /USR/SBIN/CRON (cron)
> 
> I don't recall ever seeing a full path like that in
> all caps. That is strange. If it didn't exist before,
> then you need to look into that.

That's just something cron used to do... nothing to worry about :) The
current version of cron no longer does that; see the log message for
revision 1.14 of
http://cvsweb.netbsd.org/bsdweb.cgi/src/usr.sbin/cron/do_command.c

use setproctitle() instead of uppercasing ProgramName
this makes the ps display nicer, and also avoids uppercasing the cron program
name in logs
idea from FreeBSD

-- 
Name: Dave Huang         |  Mammal, mammal / their names are called /
INet: khym@azeotrope.org |  they raise a paw / the bat, the cat /
FurryMUCK: Dahan         |  dolphin and dog / koala bear and hog -- TMBG
Dahan: Hani G Y+C 28 Y++ L+++ W- C++ T++ A+ E+ S++ V++ F- Q+++ P+ B+ PA+ PL++