LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 05-11-2015, 03:46 PM   #1
dave11
LQ Newbie
 
Registered: Jul 2012
Posts: 14

Rep: Reputation: Disabled
Strange process keeps restarting


Running Mint 13 Maya. Recently noticed system running slow, Top shows a process constantly using a large amount of CPU time, identified by a string of random letters 10 characters long. If I kill it, the process immediately restarts with a new PID and a new 10 random-character name, and uses the same excess of CPU time.

If I reboot, same thing.

Using pstree I see the process is started directly by init.

If I look up one of the process numbers under /proc, there is a cmdline file, which when opened has a varying line of code in it, seems to revolve around eth0.

If I run ls -l /proc/PID/exe I get

/bin/10 char name

but again the 10 character name changes each time I kill the process.

How do I figure out what program is restarting this process?

Thanks.
 
Old 05-11-2015, 04:10 PM   #2
dave11
LQ Newbie
 
Registered: Jul 2012
Posts: 14

Original Poster
Rep: Reputation: Disabled
Also, if I run ps auxf , the PID links to "who"
 
Old 05-12-2015, 07:34 AM   #3
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,708
Blog Entries: 4

Rep: Reputation: 3949Reputation: 3949Reputation: 3949Reputation: 3949Reputation: 3949Reputation: 3949Reputation: 3949Reputation: 3949Reputation: 3949Reputation: 3949Reputation: 3949
It's probably listed in the inittab. (Who's the owner of the process? init?)

Although this sort of behavior is, shall we say, "quite suspicious," it is also remotely possible that it is "benign, and malfunctioning."

Be aware(!) that someone might have hijacked your system and placed a rogue program in place of the (rarely if ever executed) who command. Proceed with caution, albeit not paranoia.

There should be entries in the system log to correspond with whatever's going on.

Last edited by sundialsvcs; 05-12-2015 at 07:36 AM.
 
Old 05-12-2015, 12:43 PM   #4
dave11
LQ Newbie
 
Registered: Jul 2012
Posts: 14

Original Poster
Rep: Reputation: Disabled
I was wondering if the system was somehow compromised.

I found a file with the current 10 character name, under the /etc/init.d/ folder. Here is what's in the file:

#!/bin/sh
# chkconfig: 12345 90 90
# description: mievhevcfl
### BEGIN INIT INFO
# Provides: mievhevcfl
# Required-Start:
# Required-Stop:
# Default-Start: 1 2 3 4 5
# Default-Stop:
# Short-Description: mievhevcfl
### END INIT INFO
case $1 in
start)
/usr/bin/mievhevcfl
;;
stop)
;;
*)
/usr/bin/mievhevcfl
;;
esac


Does this mean chkconfig is the offender?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
On Reboot process not restarting drkhrse01 SUSE / openSUSE 1 04-03-2012 11:15 AM
Restarting the Process Suresh42 Programming 2 04-15-2009 05:28 AM
Restarting a halted process after boot? Maverick1182 Linux - Newbie 1 09-23-2006 07:42 AM
Restarting Slimserver process wbatzle Linux - Newbie 2 09-27-2005 05:51 PM
Strange file errors after restarting X shoota Linux - Hardware 7 05-04-2005 04:24 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 07:55 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration