1

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...

ps -ef | grep stealth gives me this:

ps showing stealth process

But I have no idea where ./stealth would be since it's a relative path?

Also when I try using locate or find, I get nothing.

Any ideas how I can find and remove this process?

  • 3
    I wouldn't settle for just removing the process... – ceejayoz Dec 20 '11 at 15:36
  • 3
    What you mean a rebuild? I'm thinking that's the way I'll go. – Jesse Bunch Dec 20 '11 at 15:37
  • 1
    do a find /tmp | grep -i stealth, people with similar infections found the executables and hackers break-in tools in /tmp. – Tim Dec 20 '11 at 15:47
  • 2
  • 2
    I'd go with the nuke-and-rebuild approach, but definitely do what you can to investigate, first (disconnected from the network, if you can). See My server's been hacked EMERGENCY. – Shane Madden Dec 20 '11 at 15:52
5

If I’m not mistaken, ls -l /proc/11377/exe will tell you where the file is located. Removing it might be a whole other matter though.

  • That's excellent. Just what I was looking for. – Jesse Bunch Dec 20 '11 at 15:55
3

Your computer is compromised. If possible replace the server with an clean one or reinstall it. You should not trust it anymore.

  • That's the plan. – Jesse Bunch Dec 20 '11 at 16:09
0
  1. before running locate, run updatedb to make sure the "locate" database is current
  2. the fact that the process respawns means it is under the supervision of another process (init, daemontools, cron, etc). Look at the process parent-id to find out which process is launching it. This program will need to be examined to figure out what relationship it has to the stealth program
  3. examine the proc entry for the process id, look at /proc/[pid]/cwd this gives you the "current working directory" which will tell you where ./stealth is
  4. kill -SIGSTOP [pid] will stop (suspend) the process without killing it, letting you examine it without worrying about it doing anything further.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.