2

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...

ps -ef | grep stealth gives me this:

ps showing stealth process

But I have no idea where ./stealth would be since it's a relative path?

Also when I try using locate or find, I get nothing.

Any ideas how I can find and remove this process?

Improve this question
18
  • 3
    I wouldn't settle for just removing the process...
    – ceejayoz
    Dec 20, 2011 at 15:36
  • 3
    What you mean a rebuild? I'm thinking that's the way I'll go.
    – Jesse Bunch
    Dec 20, 2011 at 15:37
  • 1
    do a find /tmp | grep -i stealth, people with similar infections found the executables and hackers break-in tools in /tmp.
    – Tim
    Dec 20, 2011 at 15:47
  • 2
    Nuke from orbit - it's the only way to be sure
    – user9517
    Dec 20, 2011 at 15:50
  • 2
    I'd go with the nuke-and-rebuild approach, but definitely do what you can to investigate, first (disconnected from the network, if you can). See My server's been hacked EMERGENCY.
    – Shane Madden
    Dec 20, 2011 at 15:52

3 Answers 3

Reset to default
9

If I’m not mistaken, ls -l /proc/11377/exe will tell you where the file is located. Removing it might be a whole other matter though.

Improve this answer
1
  • That's excellent. Just what I was looking for.
    – Jesse Bunch
    Dec 20, 2011 at 15:55
4

Your computer is compromised. If possible replace the server with an clean one or reinstall it. You should not trust it anymore.

Improve this answer
1
  • That's the plan.
    – Jesse Bunch
    Dec 20, 2011 at 16:09
1
  1. before running locate, run updatedb to make sure the "locate" database is current
  2. the fact that the process respawns means it is under the supervision of another process (init, daemontools, cron, etc). Look at the process parent-id to find out which process is launching it. This program will need to be examined to figure out what relationship it has to the stealth program
  3. examine the proc entry for the process id, look at /proc/[pid]/cwd this gives you the "current working directory" which will tell you where ./stealth is
  4. kill -SIGSTOP [pid] will stop (suspend) the process without killing it, letting you examine it without worrying about it doing anything further.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .