0

On my ubuntu server, an unknown process is consuming all 16 of 40 cores. It starts again after I kill it.

  • Script: ld-linux-x86-64-so.2
  • Full command $HOME/.ttp/a/stak/ld-linux-x86-64-so.2 --library-path $HOME/.ttp/a/stak/

Here is output of my htop command.

enter image description here enter image description here

I tried to kill it but it starts again. It is slowing down my server. Kindly guide me how to permanently stop this process.

Muhammad Hassan
  • 299
  • 1
  • 4
  • 14
  • 1
    Monero miner: https://github.com/fireice-uk/xmr-stak Looks like your systems pwned. – muru May 17 '18 at 09:47
  • It's probably malware. There's no reason why you'd have libraries in that location anyway. Nuke it from orbit and restore from backups. That's the only sane way to deal with malware - it's difficult to detect other backdoors that may be left. – vidarlo May 17 '18 at 09:47

0 Answers0