[Wylug-help] Logwatch warning

[Nigel Metheringham]

On 1 Feb 2007, at 10:46, Anne Wilson wrote:
> The message is very puzzling.  It specifically says 'not infected',
> and my checks seem to agree with this.
>
> I don't know why it talks about crontab for nobody.

The crontabs for specific accounts are in /var/spool/cron - I would
guess you have a file named nobody in that directory. I would also guess
that this worm typically drops a crontab for nobody to ensure its
restarted on reboot.

I've looked in the logwatch set on my FC6 box and in the current CVS
version of logwatch and neither have any code which would produce this
message.

I suggest you look in the logwatch package to work out whats causing
that message and why - best place to start is probably

   less /usr/share/logwatch/scripts/services/cron

and see if there are references to nobody.

	Nigel
--
[ Nigel Metheringham           Nigel.Metheringham at InTechnology.co.uk ]
[ - Comments in this message are my own and not ITO opinion/policy - ]