Dotaz: Podivné procesy

[Vladimír Kuzba]

Zdravím, při výpisu

ps aux

se mi objevily dva podivné procesy:

root     11668  0.0  0.9  2736 1188 ?        S    16:47   0:00 ô???
root     11673  0.5  1.3  2904 1696 ?        S    16:47   0:00 ô???

Neví někdo, co je to zač? Mám podezření na něco nekalého, neb v logu mám mimo jiné:

Apr 25 01:34:11 servr     [17884]: connection from "210.212.0.252"
Apr 25 01:34:11 servr     [17884]: Wrong password given for user 'nobody'.
Apr 25 01:34:12 servr     [17885]: DNS lookup failed for "210.212.0.252".
Apr 25 01:34:16 servr     [17885]: password authentication failed. Login to account patrick not allowed or account non-existent.
Apr 25 01:34:17 servr     [17886]: DNS lookup failed for "210.212.0.252".
Apr 25 01:34:21 servr     [17886]: password authentication failed. Login to account patrick not allowed or account non-existent.
Apr 25 01:34:22 servr     [17887]: DNS lookup failed for "210.212.0.252".
Apr 25 01:34:27 servr     [17887]: connection from "210.212.0.252"
Apr 25 01:34:27 servr     [17887]: Wrong password given for user 'root'.
Apr 25 01:34:28 servr     [17888]: DNS lookup failed for "210.212.0.252".
Apr 25 01:34:32 servr     [17888]: connection from "210.212.0.252"
Apr 25 01:34:32 servr     [17888]: Wrong password given for user 'root'.
Apr 25 01:34:33 servr     [17889]: DNS lookup failed for "210.212.0.252".
Apr 25 01:34:38 servr     [17889]: connection from "210.212.0.252"
Apr 25 01:34:38 servr     [17889]: Wrong password given for user 'root'.
Apr 25 01:34:39 servr     [17890]: DNS lookup failed for "210.212.0.252".
Apr 25 01:34:43 servr     [17890]: connection from "210.212.0.252"
Apr 25 01:34:43 servr     [17890]: Wrong password given for user 'root'.
Apr 25 01:34:44 servr     [17891]: DNS lookup failed for "210.212.0.252".
Apr 25 01:34:49 servr     [17891]: connection from "210.212.0.252"
Apr 25 01:34:49 servr     [17891]: Wrong password given for user 'root'.
Apr 25 01:34:51 servr     [17912]: DNS lookup failed for "210.212.0.252".
Apr 25 01:34:55 servr     [17912]: password authentication failed. Login to account rolo not allowed or account non-existent.
Apr 25 01:34:56 servr     [17958]: DNS lookup failed for "210.212.0.252".
Apr 25 01:35:00 servr     [17958]: password authentication failed. Login to account iceuser not allowed or account non-existent.
Apr 25 01:35:01 servr     [17959]: DNS lookup failed for "210.212.0.252".
Apr 25 01:35:06 servr     [17959]: password authentication failed. Login to account horde not allowed or account non-existent.
Apr 25 01:35:07 servr     [17960]: DNS lookup failed for "210.212.0.252".
Apr 25 01:35:11 servr     [17960]: password authentication failed. Login to account cyrus not allowed or account non-existent.
Apr 25 01:35:12 servr     [17961]: DNS lookup failed for "210.212.0.252".
Apr 25 01:35:16 servr     [17961]: password authentication failed. Login to account www not allowed or account non-existent. 

Server jsem pro jistotu odstřihl od netu. Prosím jakékoli rady nebo nakopnutí...

Díky moc

Odpovědi

[spectrum]

Kdyz jakekoliv rady, tak pod rootem zkuste:
cat ~/.bash_history
pripadne treba: w
log je v pohode, pokud se nepodari prihlasit ...

[Michal Marek (twofish)]

cat /proc/11668/exe >haxor1
cat /proc/11673/exe >haxor2

ty binárky zazálohuje pro případné další zkoumání (třeba strace v emulátoru). Pak to jedině přeinstalovat...

[Vladimír Kuzba]

Děkuji za rady, podezřelé procesy patřily podvrženému SSHD; počítač byl nabouraný, takže jsem požádal svého LinuxGuru (moc díky, Jardo!) o pomoc a server jsme přeinstalovali.