Question

Strange Router System Log Entries Maleware

I noticed strange entries on our router on 10/29/21016 and they continue every 5 minutes. The cron. info hits the router every 5 minutes for 6 times then the killall occurs and the cron. info starts again. This occurs even when there are no computers connected to the router. I have: 1. Comcast, 2. Motorola surfboard 6141, 3. Belkin AC1200 Router. Here is an example: Nov 8 07:50:01 localhost cron.info crond[1096]: crond: USER root pid3725 cmd /usr/scripts/mem_sync Nov 8 07:55:01 localhost cron.info crond[1096]: crond: USER root pid3775 cmd /usr/scripts/mem_sync Nov 8 08:00:01 localhost cron.info crond[1096]: crond: USER root pid3827 cmd killall -SIGUSR2 nlinkd Nov 8 08:00:01 localhost cron.info crond[1096]: crond: USER root pid3829 cmd /usr/scripts/mem_sync Nov 8 08:05:01 localhost cron.info crond[1096]: crond: USER root pid3879 cmd /usr/scripts/mem_sync Nov 8 08:10:01 localhost cron.info crond[1096]: crond: USER root pid3931 cmd /usr/scripts/mem_sync Nov 8 08:15:01 localhost cron.info crond[1096]: crond: USER root pid3981 cmd /usr/scripts/mem_sync Nov 8 08:20:01 localhost cron.info crond[1096]: crond: USER root pid4033 cmd /usr/scripts/mem_sync Nov 8 08:25:01 localhost cron.info crond[1096]: crond: USER root pid4083 cmd /usr/scripts/mem_sync Nov 8 08:30:01 localhost cron.info crond[1096]: crond: USER root pid4131 cmd killall -SIGUSR2 nlinkd Nov 8 08:30:01 localhost cron.info crond[1096]: crond: USER root pid4133 cmd /usr/scripts/mem_sync

  • Kay

  • 1

    Ans

  • 4 years ago

Answer Link
Answer - 1

Thank you everyone. After much testing etc. I determined that the cron entries disappear when the comcast cable is detached from the modem (the modem and router are still on). In all the differ

net configurations that I tried this is the only time the cron entries did not occur. So it seems the cron entries must be coming from comcast.

I guess I'll talk to them if I can reach anyone there. Any other thoughts?

  • Published by:  Alex   
  •  4 years ago