Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a process running on my server (CentOS 5.2) that is taking up 99-100% of my CPU. The ps command reveals the name fakeproc as follows:

30571 ?        R    3620:06 fakeproc

Running top shows me that it's a perl script that is associated with this process:

30571 apache    25   0  6292 3044 1288 R  100  0.1   3621:44 perl

I tried to investigate, but didn't get much info on the location of the perl script:

$ ps -p 30571 -o command

I'm pretty sure I've got some malware (a perl script of some kind) that is creating this fakeproc, but I have no idea how to locate it or how to remove it.

Any ideas?

share|improve this question

First find out who is launching what. The following command will show which process has launched the script

ps xjf -C fakeproc

You should then be able to kill the relevant processes using

kill PID

Where PID is the process ID in question. According to this site and this one, what you are seeing could well be malware.

share|improve this answer
Yes, I've seen those sites. My problem is in trying to find where the perl script is actually located. I killed the process already, so that's no longer there to help. – ChiCgi Feb 11 '13 at 20:36
I assume you have tried searching for it. It might have left a trace somewhere, try grep -r /var/log. – terdon Feb 11 '13 at 22:01
I ended up searching through all my public files for the string fakeproc, thinking that would certainly show up somewhere in the script (grep -r 'fakeproc'). Sure enough, it did. Perhaps the filenames will be useful to someone else--mine were named nakal.txt and nakal.txt.1. Some more digging led me to believe this was all done through the TimThumb exploit of WordPress on a site hosted on the server. – ChiCgi Feb 11 '13 at 23:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .