LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices



Reply
 
Search this Thread
Old 04-21-2010, 04:09 AM   #1
kurk
LQ Newbie
 
Registered: Apr 2010
Posts: 2

Rep: Reputation: 0
[SOLVED] Output of ps command - can't find file


Hi there,

Today I found interesting issue. The output of ps command show some user's process, executing some file, let's say x.pl.

taz 2795 10.0 5.5 30568 5600 ? R 08:59 0:00 ./x.pl

I looked into taz's home directory in search of x.pl, however, found nothing.

Using find / -name x.pl also gave no results.

Interesting thing is that there are couple of such processes and the filenames look like generated automatically, ex. hyujip.pl.

Any ideas how to track down those files and which process spawns them?

Thanks!

Last edited by kurk; 04-29-2010 at 05:14 AM.
 
Old 04-21-2010, 04:52 AM   #2
ahappypengiun
LQ Newbie
 
Registered: Apr 2010
Posts: 2

Rep: Reputation: 1
Perhaps looking at the process tree will help? From the ps manpage:
To print a process tree:
ps -ejH
ps axjf
 
Old 04-21-2010, 04:58 AM   #3
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Servers: Debian Squeeze and Wheezy. Desktop: Slackware64 14.0. Netbook: Slackware 13.37
Posts: 8,563
Blog Entries: 29

Rep: Reputation: 1179Reputation: 1179Reputation: 1179Reputation: 1179Reputation: 1179Reputation: 1179Reputation: 1179Reputation: 1179Reputation: 1179
The command line ./x.pl does not imply a program in taz home directory. For example
Code:
cd ~<some user name>/bin
./x.pl
Thus, not knowing what the current working directory was when the command was issued, you need to search the whole file system hierarchy to try to find these programs. Even then you may not find them -- they could be on a networked file system that is no longer mounted. For more detail of trying to find a program, based on the command line used to start it (including why it cannot always be done) see Greg's WIKI.
 
Old 04-29-2010, 05:14 AM   #4
kurk
LQ Newbie
 
Registered: Apr 2010
Posts: 2

Original Poster
Rep: Reputation: 0
Thank you. It turned out that the system has been compromised, these scripts were uploaded via FTP, ran and deleted.
 
Old 04-29-2010, 01:44 PM   #5
tredegar
LQ 5k Club
 
Registered: May 2003
Location: London, UK
Distribution: Debian "Jessie"
Posts: 6,038

Rep: Reputation: 372Reputation: 372Reputation: 372Reputation: 372
Quote:
It turned out that the system has been compromised, these scripts were uploaded via FTP, ran and deleted.
I hope you realise your system should still be regarded as "compromised".

You have work to do.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] How to direct standard output from find command dyq Programming 3 03-26-2010 04:55 PM
Piping Output of a Command Like Find cipher7836 Linux - Newbie 13 08-16-2009 04:41 AM
[SOLVED] append command output to file by giving command in terminal sumeet inani Linux - Newbie 4 07-03-2009 11:36 AM
piping output of find to another command or loop steven19782007 Linux - Newbie 6 06-25-2009 06:29 PM
find with -exec: no command output David the H. Linux - Software 5 01-03-2008 02:53 AM


All times are GMT -5. The time now is 04:40 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration