up vote 1 down vote favorite
share [g+] share [fb]

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...

ps -ef | grep stealth gives me this:

ps showing stealth process

But I have no idea where ./stealth would be since it's a relative path?

Also when I try using locate or find, I get nothing.

Any ideas how I can find and remove this process?

link|improve this question
80% accept rate
3  
I wouldn't settle for just removing the process... – ceejayoz Dec 20 '11 at 15:36
3  
What you mean a rebuild? I'm thinking that's the way I'll go. – Jesse Bunch Dec 20 '11 at 15:37
1  
do a find /tmp | grep -i stealth, people with similar infections found the executables and hackers break-in tools in /tmp. – Tim Dec 20 '11 at 15:47
2  
2  
I'd go with the nuke-and-rebuild approach, but definitely do what you can to investigate, first (disconnected from the network, if you can). See My server's been hacked EMERGENCY. – Shane Madden Dec 20 '11 at 15:52
show 13 more comments
feedback

2 Answers

up vote 4 down vote accepted

If I’m not mistaken, ls -l /proc/11377/exe will tell you where the file is located. Removing it might be a whole other matter though.

link|improve this answer
That's excellent. Just what I was looking for. – Jesse Bunch Dec 20 '11 at 15:55
feedback
up vote 3 down vote

Your computer is compromised. If possible replace the server with an clean one or reinstall it. You should not trust it anymore.

link|improve this answer
That's the plan. – Jesse Bunch Dec 20 '11 at 16:09
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.