Q: How to stop a rogue Linux process from ever starting up again I'm running an Ubuntu 14.04 LTS server, with Apache2 and PHP 5.6.
I'm trying to find the source of a process that has been plaguing one of my servers.
I can see the process in "top", it's run by the "www-data" user, and is identified by the COMMAND "vmak". It's very strange, and most likely malicious.
I've included the list of files that the process has open below. sudo lsof -p
I am wondering if you guys could point me at any tools that could be helpful in pinpointing the source of this script, so I can remove it, or quarantine it. Are there any commands that would be useful in finding the source of this process?
I've tried a bunch, including pstree. Any help would be greatly appreciated.
As soon as I kill the process, it's started right back up.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
vmak 14645 www-data cwd DIR 8,0 4096 124901 /var/www
vmak 14645 www-data rtd DIR 8,0 4096 2 /
vmak 14645 www-data txt REG 8,0 2359872 36 /tmp/vmak (deleted)
vmak 14645 www-data mem REG 8,0 101240 8608 /lib/x86_64-linux-gnu/libresolv-2.19.so
vmak 14645 www-data mem REG 8,0 22952 11891 /lib/x86_64-linux-gnu/libnss_dns-2.19.so
vmak 14645 www-data mem REG 8,0 149120 8765 /lib/x86_64-linux-gnu/ld-2.19.so
vmak 14645 www-data mem REG 8,0 1857312 11893 /lib/x86_64-linux-gnu/libc-2.19.so
vmak 14645 www-data mem REG 8,0 43616 8605 /lib/x86_64-linux-gnu/libnss_files-2.19.so
vmak 14645 www-data 0r CHR 1,3 0t0 9114 /dev/null
vmak 14645 www-data 1w CHR 1,3 0t0 9114 /dev/null
vmak 14645 www-data 2w CHR 1,3 0t0 9114 /dev/null
vmak 14645 www-data 3r FIFO 0,11 0t0 2074158 pipe
vmak 14645 www-data 4w FIFO 0,11 0t0 2074158 pipe
vmak 14645 www-data 5u 0000 0,12 0 9112 anon_inode
vmak 14645 www-data 6r FIFO 0,11 0t0 2074159 pipe
vmak 14645 www-data 7w FIFO 0,11 0t0 2074159 pipe
vmak 14645 www-data 8u 0000 0,12 0 9112 anon_inode
vmak 14645 www-data 9r CHR 1,3 0t0 9114 /dev/null
vmak 14645 www-data 10u IPv4 2074160 0t0 TCP [FQDN-Edited-Out].com:53328->ramzansal5.example.com:3338 (ESTABLISHED)


A: There is an official release from Ubuntu that should remove the rogue process from your system:
https://www.ubuntu.com/download/server
Just download and install. You may need to set up Apache again so make backups.
