Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an application running on JBoss Applicatoin server (version 4.0.2) and its binded to a public address. Recently I found out some weird files and folders in one of my application folder. The weird files include bm.c , bm.h , bm.o , fly.pl , lindb.pl, pns, pnscan.c, pnscan.o , pns, ipsort, install-sh. These files generate some processes running on my server. When I do a ps - ef | grep pnscan, the result is :

 ps -ef | grep pnscan 

root 4159 20125 0 15:43 ? 00:00:00 sh -c ./pnscan -r JBoss -w "HEAD / HTTP/1.0\r\n\r\n" -t 6400 229.110.0.0/16 8080 > /tmp/sess_0088025413980486928597bff110229

root 4160 4159 5 15:43 ? 00:00:00 ./pnscan -r JBoss -w HEAD / HTTP/1.0\r\n\r\n -t 6400 229.110.0.0/16 8080

root 4173 2751 0 15:43 pts/1 00:00:00 grep pnscan

I couldn't kill these process as after I killed, they appeared again.

I search abt the problem and get this resolution https://access.redhat.com/kb/docs/DOC-30741 . I follow the instruction to remove the http get/set in the security constraint in the xml file deploy/jmx-console.war/WEB-INF/web.xml . After that I removed all weirds files , restart the server. Things run fine but after a while I found the weird files & folder again.

Any advice ?

share|improve this question

migrated from stackoverflow.com Nov 2 '11 at 5:46

This question came from our site for professional and enthusiast programmers.

3  
    
Thanks nos ! I'll try to see how it works :) –  Quoc Nguyen Oct 31 '11 at 9:31
    
possible duplicate of My server's been hacked EMERGENCY –  mgorven Jul 12 '12 at 0:52
add comment

1 Answer

if you are using Jboss consider about this thing

please comment the below scrept in http-invoker.sar\invoker.war\WEB-INF\web.xml file.

<!--servlet>
   <servlet-name>JMXInvokerServlet</servlet-name>
   <description>The JMXInvokerServlet receives posts containing serlized
   MarshalledInvocation objects that are routed to the invoker given by
   the the MBean whose object name hash is specified by the
   invocation.getObjectName() value. The return content is a serialized
   MarshalledValue containg the return value of the inovocation, or any
   exception that may have been thrown.
   </description>
   <servlet-class>org.jboss.invocation.http.servlet.InvokerServlet</servlet-class>
   <load-on-startup>1</load-on-startup>
</servlet--> 
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.