Find file launching a process

I think my server has been compromised and it has many perl processes running. However, I 开发者_开发百科don't know what file they are being launched from so I can delete it. How can I find this information?

If your system has been hacked, you cannot trust any of the software, not even the kernel. Format the disk and re-install everything. There is just no way to be sure you've cleaned out the infection, because you can't trust the very tools you would use to clean things. You can't copy new tools onto the box, because you can't trust the SSH daemon or the /bin/cp command. Anything -- ls, vi, ps, cat, dd, etc. -- could have been replaced with a trojan that works to hide the infected files.

You could check the symbolic link /proc/pid/cwd, also check the ppid from ps(1).

The first thing I would do is look at the parent process id (PPID). That said, if the PPID is 1, that doesn't tell you anything.

Auditing the filesystem could help see here

pstree could also help

If you run the command "ps -ef" you should get a list of all processes running on your machine. Each process will have a process id number (PID), and also a parent PID. Find the offending process(es) and check their parent PIDs. Then find the process with a matching PID, and it should be your culprit.

Try ls -l /proc/<pid>/exe, or ls -l /proc/<pid>/fd. I don't remember if perl keeps the script file open after the program starts, but if it does, it will be one of the process's file descriptors.

But if your system is pwned, don't expect anything to make sense.