Is your receiver accessible via Internet?
If yes, I guess that you get hacked by a bot net crawler.
Did you tried to boot WITHOUT Barry Allen (read: fresh
boot from a fresh image installed in boxes flash)?

Btw. After "killall", you need to start enigma2 by hand.
It will not automagically start.
Use "init 4" on the command line to stop and "init 3" to
start enigma2.

Could you please post (separately and in code tags) the output of the following commands (executed when the problems pop up again). Make sure to have puTTy set to fullscreen with a large scrollback buffer:

ps aux

dmesg

cat /var/log/messages

cat /home/root/.ssh/known_hosts

cat /home/root/.ash_history

crontab -l

From your description I would not guess botnet, but ubifs/filesystem trouble.
Some of the above commands might be helpful in ruling out an infection.
To eliminate the second flash as a culprit, make sure to follow the steps kenat described.

According to the output of SMART, I would recommend to disable the HD
(e.g. remove the SATA connector from the disk) and retry a start.
If the box starts, the HD is most probably the problem.
Although the disk is not known to the smart tool, the values are not very
promising (to say at least). Value "pre-fail" is always a bad sign.

Hmm.. pretty strange that there is no bash history.
Could you please post the output of cat /etc/cron/crontabs?
I guess the VPN connections (dawid, daniel, lupa2) are intentional and not malicious?

Would be interesting to know if the problems persist without BA and openvpn.
For further debugging you could log the box's serial output (via the service port). Maybe the kernel messages just before the freeze could shed some light on the situation.

€dit: The S.M.A.R.T. values look okay for an older hdd. They are still far enough from their thresholds.
Not sure why kenat thinks otherwise.

Regarding the interpretation of S.M.A.R.T. results, the smartctl manpage is quite helpful.
A small excerpt:

Zitat

Each Attribute also has a Threshold value (whose range is 0 to 255) which is printed under the heading "THRESH". If the Normalized value is less than or equal to the Threshold value, then the Attribute is said to have failed. If the Attribute is a pre-failure Attribute, then disk failure is imminent.
[...]
The Attribute table printed out by smartctl also shows the "TYPE" of the Attribute. Attributes are one of two possible types: Pre-failure or Old age. Pre-failure Attributes are ones which, if less than or equal to their threshold values, indicate pending disk failure. Old age, or usage Attributes, are ones which indicate end-of-product life from old-age or normal aging and wearout, if the Attribute value is less than or equal to the threshold. Please note: the fact that an Attribute is of type 'Pre-fail' does not mean that your disk is about to fail! It only has this meaning if the Attribute's current Normalized value is less than or equal to the threshold value.

Could not find an English bootlog howto with a quick google search. Here's the long version (German).
Short version:

• Connect your box to your PC (via the service port) using a mini-USB cable.
• When using Windows, install the USB to UART drivers.
• Connect to the new virtual COM port using a suitable application (e.g. PuTTy, Hyperterminal, Minicom or GNU screen) with these settings:
  
  
  Code

  Bps:				115200
  Databits:			8
  Parity:				No
  Stopbits:			1
  Flow control:			Hardware

  
  

• Boot the box.

It would be helpful if you could also answer the questions I posted above

Zitat von WilliamG

...
€dit: The S.M.A.R.T. values look okay for an older hdd. They are still far enough from their thresholds.
Not sure why kenat thinks otherwise.

Because the RAW_READ_ERROR_RATE seems unreasonably high.
The high value of seek value errors seems to be "usual" for seagate drives
but I am not sure with read errors.
A simple test (boot without HD) would reveal, if this is the cause of the
problems or not.

I think bad blocks are pretty normal. And as they are marked as bad now, they should not cause any problems.

Zitat

crontab -1

Not 1... use the l

root@dm7020hd:~# crontab -l
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.16563 installed on Fri Sep 20 00:10:02 2013)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
00 12 * * * /usr/script/moviecleaner.sh
00 19 15 * * /usr/script/backup.sh
00,15,30,45 23,00,1,2,3,4,5 * * * /usr/script/shutdown.sh
root@dm7020hd:~#

Next question:
What is /bin/mi ?

Also try

for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done

This should you show all crontabs for all users..

root@dm7020hd:/etc/cron/crontabs# for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.16563 installed on Fri Sep 20 00:10:02 2013)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
00 12 * * * /usr/script/moviecleaner.sh
00 19 15 * * /usr/script/backup.sh
00,15,30,45 23,00,1,2,3,4,5 * * * /usr/script/shutdown.sh
no crontab for daemon
no crontab for bin
no crontab for sys
no crontab for sync
no crontab for games
no crontab for man
no crontab for lp
no crontab for mail
......

also i miss the answer for this question:

Zitat

I guess the VPN connections (dawid, daniel, lupa2) are intentional and not malicious?

As far as I know, the bootloader prevents you from installing an image for the wrong version of the box. So I guess it's trial and error for you.