Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need some help, my server provider contacted me to tell me my server was using 200mbit/s bandwidth. Upon investigation I found processes for a user that should not be there.. I found processes as follows:

 26269  511     Nov27   ./stealth 58.22.68.253 53
 775    511     Oct12   ./eggdrop -m botnick.conf

I know eggdrop is IRC, my question is, where can I find out where the software has been installed for these processes?

share|improve this question
    
See serverfault.com/questions/218005/… - shut the server down, NOW, and do an offline analysis. –  Andrew Nov 28 '11 at 1:28
add comment

1 Answer 1

You've been compromised. You can kill the processes, of course.

Start by running /sbin/lsof | grep eggdrop and /sbin/lsof | grep stealth.

You should be able to see the full paths to the executables from that output. That will give you a place to start in terms of determining the directories where the bots were installed.

Kill the processes from that point and proceed to run one of the standard rootkit detection programs (rkhunter or chkrootkit).

If you have a backup, that's a good place to go. But if not, you need to determine how you were compromised, and ensure that there's nothing that will re-trigger the malicious applications (rc scripts, crontab, etc.)

Take a look at the following posts that address compromised systems:

Procedures for confirming a suspected hack? (Linux)

How do I know if my Linux server has been hacked?

What are main steps doing forensic analysis of linux box after it was hacked?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.