I need some help, my server provider contacted me to tell me my server was using 200mbit/s bandwidth. Upon investigation I found processes for a user that should not be there.. I found processes as follows:

 26269  511     Nov27   ./stealth 53
 775    511     Oct12   ./eggdrop -m botnick.conf

I know eggdrop is IRC, my question is, where can I find out where the software has been installed for these processes?


You've been compromised. You can kill the processes, of course.

Start by running /sbin/lsof | grep eggdrop and /sbin/lsof | grep stealth.

You should be able to see the full paths to the executables from that output. That will give you a place to start in terms of determining the directories where the bots were installed.

Kill the processes from that point and proceed to run one of the standard rootkit detection programs (rkhunter or chkrootkit).

If you have a backup, that's a good place to go. But if not, you need to determine how you were compromised, and ensure that there's nothing that will re-trigger the malicious applications (rc scripts, crontab, etc.)

Take a look at the following posts that address compromised systems:

Procedures for confirming a suspected hack? (Linux)

How do I know if my Linux server has been hacked?

What are main steps doing forensic analysis of linux box after it was hacked?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.