Take the 2-minute tour ×

I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...

ps -ef | grep stealth gives me this:

ps showing stealth process

But I have no idea where ./stealth would be since it's a relative path?

Also when I try using locate or find, I get nothing.

Any ideas how I can find and remove this process?

share|improve this question
I wouldn't settle for just removing the process... –  ceejayoz Dec 20 '11 at 15:36
What you mean a rebuild? I'm thinking that's the way I'll go. –  Jesse Bunch Dec 20 '11 at 15:37
do a find /tmp | grep -i stealth, people with similar infections found the executables and hackers break-in tools in /tmp. –  Tim Dec 20 '11 at 15:47
I'd go with the nuke-and-rebuild approach, but definitely do what you can to investigate, first (disconnected from the network, if you can). See My server's been hacked EMERGENCY. –  Shane Madden Dec 20 '11 at 15:52
show 13 more comments

2 Answers

up vote 4 down vote accepted

If I’m not mistaken, ls -l /proc/11377/exe will tell you where the file is located. Removing it might be a whole other matter though.

share|improve this answer
That's excellent. Just what I was looking for. –  Jesse Bunch Dec 20 '11 at 15:55
add comment

Your computer is compromised. If possible replace the server with an clean one or reinstall it. You should not trust it anymore.

share|improve this answer
That's the plan. –  Jesse Bunch Dec 20 '11 at 16:09
add comment

Your Answer


