1
vote
1answer
97 views

Process With No Name: A Possible Linux Rootkit?

Situation When I was looking at gnome-system-monitor one time, I saw a process without a name. Didn't bother me at first. Later, my laptop seemed to be heating up, and would see spikes in CPU ...
2
votes
2answers
106 views

Cannot delete folder or files inside

I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged ...
12
votes
4answers
1k views

Am I attacked or just stupid?

I run a server using Debian Squeeze with several OpenVZ containers. The containers run mostly Squeeze, some Lenny, and some already updated to Wheezy. The host doesn't do that much beyond iptables and ...
0
votes
1answer
196 views

Need guidance in understanding rkhunter results

Today, I performed a system wide scan for rootkits using the rkhunter --check command. All results were ok, with the exception of a warning: [10:14:30] Warning: The command '/usr/bin/unhide.rb' has ...
0
votes
2answers
342 views

rogue process consumes too much memory in linux

I was going through the output of top when i saw a process listed as pine -i I don't have pine in my system ! Then i got into proc and did a `ls -l /proc/9827/exe` 9827 is the process id. It ...
-1
votes
1answer
404 views

Deleting content in swap space and emptying cache using terminal in linux

Wish a script which would delete cache content and remove additional files which have been downloaded via the internet and saved voluntarily by the user and files any thing other than those used by ...
2
votes
1answer
686 views

Linux workstation: how to know if it has been rooted?

I was working on my Linux "workstation" (it has no sound and I don't play on it nor watch any movie: it's purely a work-machine, hence I call it my "workstation") and suddenly something very weird ...
1
vote
1answer
1k views

I can't edit /etc/init.d/rc.sysinit as local - vi says it's [readonly]

I have a rootkitted SUSE Linux and I'm trying to fix it. I have root privileges but when I go: cd /etc/init.d vi rc.sysinit vi tells me the file is [readonly]. The owner of the file is root.root ...