Good morning,
At the client location
os is CentOS. In all the terminals i.e F1, F2, F3....F10 PING command is continuously running. I tried to terminate it using CTRL C or quit but unable to stop that command in all the terminals. How to stop that? Howto find batch files which are being run by hackers?
I'm not expert in unix flavour. Please help me.
If you are hacked, then the processes that are sending ping are most likely going to restart, even if you kill them. You need to find the files on the system doing this first. I would try to run the following as root to get the PID of any process sending out ping:
ps faux | awk '/ping/ { print $2 }'
Then try grepping the PIDs from lsof to see if you can find the files associated with this.
If ping is being ran as root, or the files that is sending the ping requests are owned by root, you probably need a complete reload of Centos. Otherwise just chmod 000 any malicious files you find or remove them.
Hi ,
Thank you for your reply to my query regarding ping loop .
Sorry, I hate seeing awk used in this way.
pgrep ping
Andrew