Still struggling with a strange cronjobs

I am struggling with strange crontab jobs, I have disabled many time but it comes again and again, any idea what is the root cause of such job and how I resolve it?


VPS - ubuntu 16.04 - firewall enabled
Installed Apps
ERPNext: v11.1.35 (master)
Frappe Framework: v11.1.32 (master)


What is the content of the files?

cat /home/frappe/.firefoxcatche/a/upd /home/frappe/.firefoxcatche/b/sync

ubuntu@vps632278:~$ cat /home/frappe/.firefoxcatche/a/upd /home/frappe/.firefoxcatche/b/sync
cd /home/frappe/.firefoxcatche/a
if test -r /home/frappe/.firefoxcatche/a/; then
pid=$(cat /home/frappe/.firefoxcatche/a/
if $(kill -CHLD $pid >/dev/null 2>&1)
exit 0
./run &>/dev/null
cd /home/frappe/.firefoxcatche/b

I think you should get rid of those files and the cron entries.

crontab -e #this will allow you to edit the cron file for your user
#remove all the lines that refer to .firefoxcatche
#if you are using nano to edit, Ctrl-k deletes the line you are on. If you are using vi, then press the "d" key twice to delete a line

#Remove the actual files - these start with a dot, so in normal display mode they are "hidden" - which is not a good indication since they don't look like they are config or useful files.
rm --recursive --force /home/frappe/.firefoxcatche

The @reboot forces the scripts to reload even after you have rebooted - also doesn’t seem like a good thing to me, but maybe I am just biased :smile:

Done, how I can test that issue resolved, thx a lot

its a crypto mining attack also ???

same issue faced !