[SOLVED] Output of ps command - can't find file
Hi there,
Today I found interesting issue. The output of ps command show some user's process, executing some file, let's say x.pl. taz 2795 10.0 5.5 30568 5600 ? R 08:59 0:00 ./x.pl I looked into taz's home directory in search of x.pl, however, found nothing. Using find / -name x.pl also gave no results. Interesting thing is that there are couple of such processes and the filenames look like generated automatically, ex. hyujip.pl. Any ideas how to track down those files and which process spawns them? Thanks! |
Perhaps looking at the process tree will help? From the ps manpage:
To print a process tree: ps -ejH ps axjf |
The command line ./x.pl does not imply a program in taz home directory. For example
Code:
cd ~<some user name>/bin |
Thank you. It turned out that the system has been compromised, these scripts were uploaded via FTP, ran and deleted.
|
Quote:
You have work to do. |
All times are GMT -5. The time now is 04:18 PM. |