Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I noticed some strange python process trying to access IPs which seem to belong to Google, such as 74.125.77.109 (according to whois). The process has this initialization command in ps:

bash -c P=python2; $P -V 2>/dev/null || P=python; "$P" -c 'import sys; \
  skip_imports=1; verbosity=2; exec compile(sys.stdin.read(764), \
  "assembler.py", "exec")'

Any ideas what this could be?

share|improve this question
3  
Does not look good from the security POV. Please do #locate assembler.py and try to open that file. –  lzap May 16 '11 at 9:04
1  
Try running pstree -H the_pid_of_that_procees. It could give you better clues as to what exactly spawned that. –  Mat May 16 '11 at 9:08
    
I have seen Google using python for internal components before, but this is a bit odd. All of the tips here are good: find assembler.py, check out the process tree, and take a look in the proc filesystem. –  jcrawfordor Aug 31 '11 at 20:20

2 Answers 2

ls -l /proc/<pid> and ls -l /proc/<pid>/fd may tell you more.

share|improve this answer
up vote 0 down vote accepted

Turns out it belongs to sshuttle which was running at that time.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.