Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...

ps -ef | grep stealth gives me this:

ps showing stealth process

But I have no idea where ./stealth would be since it's a relative path?

Also when I try using locate or find, I get nothing.

Any ideas how I can find and remove this process?

share|improve this question
3  
I wouldn't settle for just removing the process... –  ceejayoz Dec 20 '11 at 15:36
3  
What you mean a rebuild? I'm thinking that's the way I'll go. –  Jesse Bunch Dec 20 '11 at 15:37
1  
do a find /tmp | grep -i stealth, people with similar infections found the executables and hackers break-in tools in /tmp. –  Tim Dec 20 '11 at 15:47
2  
2  
I'd go with the nuke-and-rebuild approach, but definitely do what you can to investigate, first (disconnected from the network, if you can). See My server's been hacked EMERGENCY. –  Shane Madden Dec 20 '11 at 15:52

2 Answers 2

up vote 4 down vote accepted

If I’m not mistaken, ls -l /proc/11377/exe will tell you where the file is located. Removing it might be a whole other matter though.

share|improve this answer
    
That's excellent. Just what I was looking for. –  Jesse Bunch Dec 20 '11 at 15:55

Your computer is compromised. If possible replace the server with an clean one or reinstall it. You should not trust it anymore.

share|improve this answer
    
That's the plan. –  Jesse Bunch Dec 20 '11 at 16:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.