Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need some help, my server provider contacted me to tell me my server was using 200mbit/s bandwidth. Upon investigation I found processes for a user that should not be there.. I found processes as follows:

 26269  511     Nov27   ./stealth 53
 775    511     Oct12   ./eggdrop -m botnick.conf

I know eggdrop is IRC, my question is, where can I find out where the software has been installed for these processes?

share|improve this question
See… - shut the server down, NOW, and do an offline analysis. – Andrew Nov 28 '11 at 1:28

You've been compromised. You can kill the processes, of course.

Start by running /sbin/lsof | grep eggdrop and /sbin/lsof | grep stealth.

You should be able to see the full paths to the executables from that output. That will give you a place to start in terms of determining the directories where the bots were installed.

Kill the processes from that point and proceed to run one of the standard rootkit detection programs (rkhunter or chkrootkit).

If you have a backup, that's a good place to go. But if not, you need to determine how you were compromised, and ensure that there's nothing that will re-trigger the malicious applications (rc scripts, crontab, etc.)

Take a look at the following posts that address compromised systems:

Procedures for confirming a suspected hack? (Linux)

How do I know if my Linux server has been hacked?

What are main steps doing forensic analysis of linux box after it was hacked?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.