Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was going through the output of top when i saw a process listed as

pine -i

I don't have pine in my system ! Then i got into proc and did a

`ls -l /proc/9827/exe`

9827 is the process id. It points to a directory like


I looked into the directory and found nothing. There is nothing like test in my directory.

Then I used unhide (all options)- which didn't detect anything at all. Then I used chkrootkit , it didnt find anything amiss either.

I tried killing that process but it returns everytime after a reboot. What should I do ?

share|improve this question

migrated from Mar 7 '12 at 4:39

This question came from our site for professional and enthusiast programmers.

Did you look through the init scripts to see what's starting it? That might give you a clue. – TMN Mar 6 '12 at 18:21
I did not find anything in that directory, there is nothing like test in it. It contains only my assignment pdfs. init script is untouched. I checked twice. It actually comes up some-time may be a few minutes (6 - 10) after the system starts. – F F Mar 6 '12 at 18:26
I meant the system init scripts, in /etc/init.d... – TMN Mar 6 '12 at 18:31
It could very well be that your root password has been compromised. Disconnect from the network (Physically - actually unplug it), reboot, and see what happens. – Tyler Eaves Mar 6 '12 at 18:36
Tyler Eaves, it still starts after some time as I said earlier. – F F Mar 6 '12 at 18:50

Sounds like time to wipe and reinstall to me. That certainly smells like you've been rooted. chkrootkit isn't infallible.

share|improve this answer
Please suggest more solutions. Re-install is the last thing which I am willing to do. Its not my box actually. I was actually surprised that unhide and chkrootkit both failed miserably. – F F Mar 6 '12 at 18:16
This is a situation where you don't screw around. Something is clearly going on that you don't understand, know about, or control. – Tyler Eaves Mar 6 '12 at 18:17

You can use watch to watch logs then && killall nameofprocess. Read the man on watch. That pine proccess will be in /etc/init.d/. Somewhere so do.

Cd /etc/init.d/
ls -R * | grep pine

And that should tell you where it is and you can remove it from your startup. Better than watch running constantly too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.