Существуют crontab, может быть вредоносное программное обеспечение

Я нуждаюсь в помощи для, объясняют и разрешают о журнале мой сервер, системный журнал всегда записывает журнал

CRON[8944]: (ftpuser) CMD (/home/ftpuser/.profiles/y >/dev/null 2>&1)

хотя я был, удаляют пользователя ftpuser и пользователь корневого каталога.

Oct 14 09:32:01 sarirotidbdr CRON[8944]: (ftpuser) CMD (/home/ftpuser/.profiles/y >/dev/null 2>&1)
Oct 14 09:32:04 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:32:04 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:32:04 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:32:04 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:32:23 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:32:23 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:32:49 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:32:49 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:32:49 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:32:49 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:33:01 sarirotidbdr CRON[11192]: (ftpuser) CMD (/home/ftpuser/.profiles/y >/dev/null 2>&1)
Oct 14 09:33:32 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:33:32 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:33:44 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:33:44 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:33:44 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:33:44 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:34:01 sarirotidbdr CRON[11228]: (ftpuser) CMD (/home/ftpuser/.profiles/y >/dev/null 2>&1)
Oct 14 09:34:20 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:34:20 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:34:48 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:34:48 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:34:48 sarirotidbdr SQLAnywhere(nicsecondaryserver): Connection terminated abnormally
Oct 14 09:34:48 sarirotidbdr SQLAnywhere(nicsecondaryserver): Disconnected TCPIP client's AppInfo: HOST=sarirotiappdr
Oct 14 09:35:01 sarirotidbdr CRON[11258]: (ftpuser) CMD (/home/ftpuser/.profiles/y >/dev/null 2>&1)