[CLUG] Very Strange Process on Fedora Core 1 box

[AJ McKee]

Hi Ronan,

Yeah its an odd one alright, never seen it before. Checked to make sure it
was not rooted and all seems fine. Just incase I am moving his stuff now.
Upon further investigation, it appeared to be some type of process related
to mgetty, and a terminal server his hosting provider had. I forced a reboot
and am going through the process of shutting down each process he does not
need and seeing what the terminal service his HP uses to find out if there
is any know issues, but its quite odd. 

Apart from logrotate and the normal stuff, there is noting in cron. 

Will let you know what I find, cheers for the help

AJ 

> -----Original Message-----
> From: cork-bounces at linux.ie [mailto:cork-bounces at linux.ie] On 
> Behalf Of Ronan Kirby
> Sent: 07 October 2005 13:27
> To: AJ McKee
> Cc: clug at linux.ie
> Subject: Re: [CLUG] Very Strange Process on Fedora Core 1 box
> 
> Hmmm....
> 
> It could always be rooted :o) It's also been suggested that 
> maybe its a
> process with extended non-7-bit characters encoded in UTF-8 name and
> through a shell with no UTF-8.
> 
> ls -l /proc/28002/exe and same for 28003 will show what 
> started it. Then
> a cat on /proc/28002/maps environ and cmdline will show more and might
> help reveal what it is.
> 
> - R
> 
> On Fri, 2005-10-07 at 13:16 +0100, Ronan Kirby wrote:
> > On Fri, 2005-10-07 at 12:40 +0100, AJ McKee wrote:
> > [SNIP!]
> > > root     28002  0.0  0.1  3020  608 ?        D    Sep24   
> 0:00 ??õ¿D
> > > root     28003  0.0  0.1  3020  608 ?        D    Sep24   
> 0:00  \_ ??õ¿D
> > 
> > Wow - that's, erm, interesting!
> > 
> > I wouldn't mind seeing what more you could grab on those 
> processes with
> > an lsof. Might help determine what they are. Interesting 
> that it seems
> > to spawn every day too. What kind of stuff is in the cron 
> (just out of
> > interest, not likely to be related).
> > 
> > - R
> > _______________________________________________
> > Cork mailing list
> > Cork at linux.ie
> > http://www.linux.ie/mailman/listinfo/cork
> _______________________________________________
> Cork mailing list
> Cork at linux.ie
> http://www.linux.ie/mailman/listinfo/cork
>