up vote 3 down vote favorite
share [g+] share [fb]

I have a process being started on my server that appears to modify what ps/top sees, so I don't know the filename or the path of it since it's hiding it (it's a perl script). How can I track down where the file is on disk?

link|improve this question
100% accept rate
How do you know you have a hidden process ? – Iain♦ Dec 29 '11 at 14:14
How did you know that? – Khaled Dec 29 '11 at 14:15
The process isn't hidden, it's just modifying what you see. I know this because I've tracked it down before (mostly due to luck) in /tmp and this is behaving the same. It's a virus being uploaded onto a shared hosting server via some client's insecure site. What ps sees is /usr/sbin/httpd (perl5.8.8) which doesn't exist on disk. – brent Dec 29 '11 at 14:20
If it is a Perl script, surely you can read the Perl script and see what is going on – fpmurphy Dec 29 '11 at 14:21
@fpmurphy: That's the issue of the topic, I can't locate it on disk this time as they've not used /tmp – brent Dec 29 '11 at 14:25
feedback

2 Answers

up vote 3 down vote accepted

Under /proc/<pid>/ there are various files which may help you find the culprit.

  • cmdline is the command line used to start the process (including parameters). Unfortunately, this is apparently also changed if the process modifies its own command line.
  • cwd is the working dir of the process, that might help as well
  • exe points to the running executable (however, for Perl scripts that will be the Perl interpreter, so might not be so helpful)
  • status contains various information. In particular, the parent process (Ppid) may be interesting; that will be the process that launched the script - might be helpful to find out who starts it.
  • under fd, you'll find the list of files the process has currently opened (as symlinks); that should help figure out what it does
link|improve this answer
Janneb's answer is better - if the executable was found on the path, or run from an explicit relative path (since the cwd may not be what it was when it started). So really the exe link is the only clue here. In the case of a script running in an interpreter, to find the script, use lsof – symcbean Dec 29 '11 at 17:01
@symcbean: Good points. Why not make that an answer? – sleske Dec 29 '11 at 17:21
feedback
up vote 1 down vote

On Linux you can check the /proc/[PID]/exe symlink, which points to the executable.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.