Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an application running on JBoss Applicatoin server (version 4.0.2) and its binded to a public address. Recently I found out some weird files and folders in one of my application folder. The weird files include bm.c , bm.h , bm.o , ,, pns, pnscan.c, pnscan.o , pns, ipsort, install-sh. These files generate some processes running on my server. When I do a ps - ef | grep pnscan, the result is :

 ps -ef | grep pnscan 

root 4159 20125 0 15:43 ? 00:00:00 sh -c ./pnscan -r JBoss -w "HEAD / HTTP/1.0\r\n\r\n" -t 6400 8080 > /tmp/sess_0088025413980486928597bff110229

root 4160 4159 5 15:43 ? 00:00:00 ./pnscan -r JBoss -w HEAD / HTTP/1.0\r\n\r\n -t 6400 8080

root 4173 2751 0 15:43 pts/1 00:00:00 grep pnscan

I couldn't kill these process as after I killed, they appeared again.

I search abt the problem and get this resolution . I follow the instruction to remove the http get/set in the security constraint in the xml file deploy/jmx-console.war/WEB-INF/web.xml . After that I removed all weirds files , restart the server. Things run fine but after a while I found the weird files & folder again.

Any advice ?

share|improve this question

migrated from Nov 2 '11 at 5:46

This question came from our site for professional and enthusiast programmers.

Thanks nos ! I'll try to see how it works :) – Quoc Nguyen Oct 31 '11 at 9:31
possible duplicate of My server's been hacked EMERGENCY – mgorven Jul 12 '12 at 0:52

if you are using Jboss consider about this thing

please comment the below scrept in http-invoker.sar\invoker.war\WEB-INF\web.xml file.

   <description>The JMXInvokerServlet receives posts containing serlized
   MarshalledInvocation objects that are routed to the invoker given by
   the the MBean whose object name hash is specified by the
   invocation.getObjectName() value. The return content is a serialized
   MarshalledValue containg the return value of the inovocation, or any
   exception that may have been thrown.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.