Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.
process keeps calling itself...
I have 1000+ of these - and it appears the parent process for each I have checked is the same command... not sure what is going on... any ideas?
8012 32605 0.0 0.0 110016 1264 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32610 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32611 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32617 0.0 0.0 110016 1272 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32618 0.0 0.0 110016 1264 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32623 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32625 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32629 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32632 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32635 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32639 0.0 0.0 110016 1272 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32641 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32646 0.0 0.0 110016 1272 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32647 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32653 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32654 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32659 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32661 0.0 0.0 110016 1264 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32665 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32668 0.0 0.0 110016 1264 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32671 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32675 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32677 0.0 0.0 110016 1272 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32682 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32683 0.0 0.0 110016 1264 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32689 0.0 0.0 110016 1272 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32690 0.0 0.0 110016 1272 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32695 0.0 0.0 110016 1264 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32697 0.0 0.0 110016 1264 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32701 0.0 0.0 110016 1264 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32704 0.0 0.0 110016 1272 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32707 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32711 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32713 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32718 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32719 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32725 0.0 0.0 110016 1268 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32726 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32731 0.0 0.0 110016 1264 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32733 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32737 0.0 0.0 110016 1264 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32740 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32743 0.0 0.0 110016 1264 ? S 01:21 0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012 32747 0.0 0.0 110016 1268 ? S 01:22 0:00 /bin/csh test -d /usr/lib64/qt-3.3
Who is Participating?
Experts Exchange Solution brought to you by
Enjoy your complimentary solution view.
Get every solution instantly with Premium.
Start your 7-day free trial.
I wear a lot of hats...
"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.
Thanks!
So to be clear 8012 is the UID running the procs... I was trying to find easy way to show PID and PPID without having to resort to a custom format via the o option.
I was also trying to see if there was a way I could run one command to see the complete process inheritance... I tried pstree though and I just get this...
Any ideas? Thanks!
So to be clear 8012 is the UID running the procs... I was trying to find easy way to show PID and PPID without having to resort to a custom format via the o option.
I was also trying to see if there was a way I could run one command to see the complete process inheritance... I tried pstree though and I just get this...
/root # pstree 32663
test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test+
[root@cati.vm.opinionaccess.com] /root #
Any ideas? Thanks!
FYI this seems very similar to my problem but it was not my problem (posting in case it helps someone else)
https://support.ca.com/us/knowledge-base-articles.TEC1711985.html
I tried
pkill test
and
killall test
I even ran these 100 times in a row in a script and it got the count down for a while but it would shoot back up...
Eventually I realized I should do (where 8012 was the uid)
ps aux | grep 8012 | grep -v test
to find any non "test" processes from the user and kill those. There was a hung process... it was a script, and I suspect the script had problems with mutt which was configured to use gmail to send email, but a password reset was needed... I think somehow that got in this strange loop. Anyway, killing that process and then another pkill test finally did it.
I fixed this eventual
https://support.ca.com/us/knowledge-base-articles.TEC1711985.html
I tried
pkill test
and
killall test
I even ran these 100 times in a row in a script and it got the count down for a while but it would shoot back up...
Eventually I realized I should do (where 8012 was the uid)
ps aux | grep 8012 | grep -v test
to find any non "test" processes from the user and kill those. There was a hung process... it was a script, and I suspect the script had problems with mutt which was configured to use gmail to send email, but a password reset was needed... I think somehow that got in this strange loop. Anyway, killing that process and then another pkill test finally did it.
I fixed this eventual
The pstree output seems to indicate the test script is calling itself infinitely.
Maybe...
Try something like...
or
Maybe...
Try something like...
ps -p 8012
or
ps auxww | grep 0812 | head
Thanks!
So to be clear 8012 is the UID not the PID
Also - This is already solved and the processes are stopped. See my previous post :-)
So to be clear 8012 is the UID not the PID
Also - This is already solved and the processes are stopped. See my previous post :-)
FYI this seems very similar to my problem but it was not my problem (posting in case it helps someone else)
https://support.ca.com/us/knowledge-base-articles.TEC1711985.html
I tried
pkill test
and
killall test
I even ran these 100 times in a row in a script and it got the countdown for a while but it would shoot back up...
Eventually, I realized I should do (where 8012 was the uid)
ps aux | grep 8012 | grep -v test
to find any non "test" processes from the user and kill those. There was a hung process... it was a script, and I suspect the script had problems with mutt which was configured to use gmail to send email, but a password reset was needed... I think somehow that got in this strange loop. Anyway, killing that process and then another pkill test finally did it.
Experts Exchange Solution brought to you by
Your issues matter to us.
Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.
Start your 7-day free trial
because i figured it out, and posted what I did to fix the issue. Thanks to David for the help though!! :-)
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux
From novice to tech pro — start learning today.
-
Microsoft ApplicationsCertification: MOS Microsoft Office Specialist - Excel 2013 Part … 146 lessons
Experts Exchange Solution brought to you by
Enjoy your complimentary solution view.
Get every solution instantly with Premium.
Start your 7-day free trial.
Looks to me like the culprit is pid == 8012, which looks to be the parent of the processes you've listed.