hunting trojans: does vmail user need its own crond??

[Brandon Vincent (Student)]

Robert,

Can you post the absolute path to the crond executable?

readlink -f /proc/3336/exe

Then, pstree can help you find what started the process:

pstree -H 1013

Brandon Vincent