Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was going through the output of top when i saw a process listed as

pine -i

I don't have pine in my system ! Then i got into proc and did a

`ls -l /proc/9827/exe`

9827 is the process id. It points to a directory like

 /home/ff/notes/pinb/test 

I looked into the directory and found nothing. There is nothing like test in my directory.

Then I used unhide (all options)- which didn't detect anything at all. Then I used chkrootkit , it didnt find anything amiss either.

I tried killing that process but it returns everytime after a reboot. What should I do ?

share|improve this question

migrated from stackoverflow.com Mar 7 '12 at 4:39

This question came from our site for professional and enthusiast programmers.

    
Did you look through the init scripts to see what's starting it? That might give you a clue. –  TMN Mar 6 '12 at 18:21
    
I did not find anything in that directory, there is nothing like test in it. It contains only my assignment pdfs. init script is untouched. I checked twice. It actually comes up some-time may be a few minutes (6 - 10) after the system starts. –  F F Mar 6 '12 at 18:26
    
I meant the system init scripts, in /etc/init.d... –  TMN Mar 6 '12 at 18:31
1  
It could very well be that your root password has been compromised. Disconnect from the network (Physically - actually unplug it), reboot, and see what happens. –  Tyler Eaves Mar 6 '12 at 18:36
    
Tyler Eaves, it still starts after some time as I said earlier. –  F F Mar 6 '12 at 18:50

2 Answers 2

Sounds like time to wipe and reinstall to me. That certainly smells like you've been rooted. chkrootkit isn't infallible.

share|improve this answer
    
Please suggest more solutions. Re-install is the last thing which I am willing to do. Its not my box actually. I was actually surprised that unhide and chkrootkit both failed miserably. –  F F Mar 6 '12 at 18:16
2  
This is a situation where you don't screw around. Something is clearly going on that you don't understand, know about, or control. –  Tyler Eaves Mar 6 '12 at 18:17

You can use watch to watch logs then && killall nameofprocess. Read the man on watch. That pine proccess will be in /etc/init.d/. Somewhere so do.

Cd /etc/init.d/
ls -R * | grep pine

And that should tell you where it is and you can remove it from your startup. Better than watch running constantly too.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.