Over about the last week or two, I have been seeing something odd with my Linux mint PC.

Over a day or 2, at some point, my CPU usage hits and saturates at or near 100 at some point (according to my conky, htop shows 1 of my CPUs saturated at 100% in red). Now I see that my memory usage is starting to reach extremely high levels (3gb) while the highest mem usage process is firefox, by far(600mb).

Is it possible I have some sort of virus/malware/rootkit? I understand that this kind of behavior is the forte of rootkits. If possible, is there a way for me to fix this? Or just reinstall?

TL;DR - Often my CPU Usage and/or my Mem Usage is high, but top/htop do not show any processes that might be responsible for this.

  • I'd start by determining the process responsible for the usage before jumping to conclusions, but if you do find you are infected, a scorched-earth rebuild is a good idea. if you can't even monitor your processes though, perhaps a reboot with the magic reisub is in order. – Frank Thomas Apr 5 '14 at 8:31
  • High RAM usage is normal. Operating systems try as hard as they can to use as much RAM as possible. Any RAM not used is forever wasted. It's not like an 8GB machine can use 4GB today so it can use 12GB tomorrow. RAM that's not being used it no better than RAM that's not in the machine. As for the CPU usage, that might be a real problem, but most likely you're just not diagnosing it correctly. – David Schwartz Apr 5 '14 at 8:51
  • @DavidSchwartz I understand what you are saying, but I believe htop shows, in its numbers, only the amount actually used(reserved is it?), and not the cached part as well – Karthik T Apr 5 '14 at 11:14
  • @FrankThomas Sound advice, but as I say, I cant see a process that can be responsible, hence my predicament. I read that rootkits are processes that hide other malicious processes from tools like top and ps, thus my conclusion. Today, this issue also drastically slowed(mouse lag, typing lag, switching workspace lag, etc) my PC, until it eventually froze, – Karthik T Apr 5 '14 at 11:15
  • @KarthikT That doesn't change anything. The best way to use the RAM may change based on the workload. For example, it might be used to make existing memory mapping resident, which is not considered cache. Or it might be used by a memory balloon driver, which is again not considered cache. – David Schwartz Apr 5 '14 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.