Processes spawning randomly and sucking CPU

Question

I am currently on Ubuntu 16.04, and I have noticed slowdowns across the server in general. Upon viewing htop, I noticed that processes with random commands are spawning, while taking the CPU usage with it; Here is the image that shows an offending process. When trying to view which user started the process, the pts shows as a '?' as shown below:

# ps -feww | grep netstat
root      7444     1 91 01:29 ?        00:01:37 netstat -antop
root     13051     1  0 01:31 ?        00:00:00 netstat -antop
root     13063     1  0 01:31 ?        00:00:00 netstat -antop

I successfully killed the process with signal 9, but after a few seconds, another process with a completely different command pops up, and ran until I killed it. Rebooting the server did not fix this.

Would appreciate some advice on this, thanks!

The commands really show no resemblance. I've noticed ls grep and pwd off the top of my head — Alucard, Oct 18 '16 at 03:00
Have you tried running `who` and ensuring that everyone that is listed in expected? — R. S., Oct 18 '16 at 04:32
Your server could be compromised. Read http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server for information on how to deal with it. — Tero Kilkanen, Oct 18 '16 at 10:38
@TeroKilkanen was right, I found a suspicious file on /bin, XorDos rootkit, resolved now. — Alucard, Oct 18 '16 at 21:20

score 0 · Answer 1 · answered Oct 18 '16 at 21:20

0

Turns out the server was compromised from XorDos, causing it to run random process while doing a spoofed UDP flood.

answered Oct 18 '16 at 21:20

Alucard

1
3

1

I hope you have re-installed the system from backups, since deleting one file doesn't resolve anything. – Tero Kilkanen Oct 18 '16 at 21:25
Did a full wipe and reinstall so its gone in the wind – Alucard Oct 19 '16 at 18:22

score 0 · Answer 2 · answered Feb 15 '17 at 02:00

here is a solution

https://admin-ahead.com/forum/server-security-hardening/unix-trojan-ddos_xor-1-chinese-chicken-multiplatform-dos-botnets-trojan/

so your virus is in /lib/libudev.so or /lib/libudev4.so

you need to chattr -i /lib/libudev.so then remove,reboot and then delete all other crap (check URL above)

you can install ClamAV for linux https://www.centosblog.com/how-to-install-clamav-and-configure-daily-scanning-on-centos/

Processes spawning randomly and sucking CPU

2 Answers2