-3

Here is out of ps aux| grep atd on my server.

apache    1299  0.0  0.0   5328  2768 ?        S    08:21   0:00 /usr/sbin/atd
root     15407  0.0  0.0   4020   708 pts/3    S+   11:02   0:00 grep atd
apache   16506  0.0  0.0   5328  2808 ?        S    08:52   0:00 /usr/sbin/atd

The process atd is not even present on its physical path, but the above path shows that it is there and its running under apache. how to track and detect its activity?

Jenny D
  • 27,780
  • 21
  • 75
  • 114
Farhan
  • 4,269
  • 11
  • 49
  • 80
  • That looks like the regular at daemon. `man atd` should tell you more. – Jenny D Apr 23 '14 at 10:17
  • but why its running under apache as well as i have moved its executable from its original location. – Farhan Apr 23 '14 at 10:19
  • Moving the binary doesn't make the running process disappear; why would it? As for why it's running under apache - that would be because it was invoked by the apache user. Please read `man at` and `man atd` – Jenny D Apr 23 '14 at 10:26
  • the executable has been many times killed and server is restarted as well. when its not even present at its original location, how can apache run it? from where? when it does not even exist? – Farhan Apr 23 '14 at 10:27

2 Answers2

3

If you don't give us all the information then it's difficult for us to help diagnose your problem/answer your question.

Based upon your coyness I'm going to guess that your system has been compromised and you know what's coming now

Reinstall your system

Reinstall the system it's the only way to be sure.

Community
  • 1
user9517
  • 115,471
  • 20
  • 215
  • 297
1

First: Stop sabotaging your own system. Randomly deleting files because you don't know what they are doing is a very bad idea.

Second: It runs under the apache uid because it's doing things on it's behalf and even if you delete the file, it won't get really deleted until the last process referencing it terminates, and since atd is a daemon, that is not the case before you terminate it or reboot the system.

Sven
  • 98,649
  • 14
  • 180
  • 226
  • i was aware of its activity, there was a reason to move the binary file,that i have not mentioned it here. and server is rebooted already – Farhan Apr 23 '14 at 10:30