biapar · January 11, 2016 12:32
diff --git a/hacked wordpress scan b/hacked wordpress scan
 /usr/bin/host has been preloaded;
 grep -ri --include=*.php "/usr/bin/host" ./  



 check all cronjobs:
 for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done

 check running processes:
 ps -aux
 and kill with:
 pkill -9 -u `id -u username`
	/usr/bin/host has been preloaded;
	grep -ri --include=*.php "/usr/bin/host" ./



	check all cronjobs:
	for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done

	check running processes:
	ps -aux
	and kill with:
	pkill -9 -u `id -u username`