I have an application running on JBoss Applicatoin server (version 4.0.2) and its binded to a public address. Recently I found out some weird files and folders in one of my application folder. The weird files include bm.c , bm.h , bm.o , fly.pl , lindb.pl, pns, pnscan.c, pnscan.o , pns, ipsort, install-sh. These files generate some processes running on my server. When I do a ps - ef | grep pnscan, the result is :
ps -ef | grep pnscan root 4159 20125 0 15:43 ? 00:00:00 sh -c ./pnscan -r JBoss -w "HEAD / HTTP/1.0\r\n\r\n" -t 6400 229.110.0.0/16 8080 > /tmp/sess_0088025413980486928597bff110229
root 4160 4159 5 15:43 ? 00:00:00 ./pnscan -r JBoss -w HEAD / HTTP/1.0\r\n\r\n -t 6400 229.110.0.0/16 8080
root 4173 2751 0 15:43 pts/1 00:00:00 grep pnscan
I couldn't kill these process as after I killed, they appeared again.
I search abt the problem and get this resolution https://access.redhat.com/kb/docs/DOC-30741 . I follow the instruction to remove the http get/set in the security constraint in the xml file deploy/jmx-console.war/WEB-INF/web.xml . After that I removed all weirds files , restart the server. Things run fine but after a while I found the weird files & folder again.
Any advice ?