Re: Another thread about a non-killable process

[heba <mat.r.gl@gmail.com>]

2006/7/11, Joshua J. Kugler <joshua@eeinternet.com>:

> Win32?  Huh?  This is a Debian system.  Proftpd is locked (won't accept
> connections, even though it shows listening on *:ftp.

yes...^^...also this is a debian system is not exempt by trojan and virus...^_^




> This is what top shows:
>
>   899 ftp       39  19  4164 2216 3460 R 98.4  0.2  27190:02 proftpd
>
> Output of lsof|grep proftpd
>
> proftpd     899      ftp  cwd       DIR        9,1     4096          2 /
> proftpd     899      ftp  rtd       DIR        9,1     4096          2 /
> proftpd     899      ftp  txt       REG        9,1   568812
> 501112 /usr/sbin/proftpd
> proftpd     899      ftp  mem       REG        9,1    90248
> 646521 /lib/ld-2.3.2.so
> proftpd     899      ftp  mem       REG        9,1    18876
> 646565 /lib/tls/libcrypt-2.3.2.so
> proftpd     899      ftp  mem       REG        9,1    11024
> 646488 /lib/libcap.so.1.10
> proftpd     899      ftp  mem       REG        9,1    28880
> 646421 /lib/libwrap.so.0.7.6
> proftpd     899      ftp  mem       REG        9,1    73304
> 646569 /lib/tls/libnsl-2.3.2.so
> proftpd     899      ftp  mem       REG        9,1   198576
> 486306 /usr/lib/i686/cmov/libssl.so.0.9.7
> proftpd     899      ftp  mem       REG        9,1  1029672
> 486305 /usr/lib/i686/cmov/libcrypto.so.0.9.7
> proftpd     899      ftp  mem       REG        9,1    30360
> 646516 /lib/libpam.so.0.76
> proftpd     899      ftp  mem       REG        9,1  1254468
> 646564 /lib/tls/libc-2.3.2.so
> proftpd     899      ftp  mem       REG        9,1     9872
> 646566 /lib/tls/libdl-2.3.2.so
> proftpd     899      ftp  mem       REG        9,1    34748
> 646572 /lib/tls/libnss_files-2.3.2.so
> proftpd     899      ftp  mem       REG        9,1    28616
> 646570 /lib/tls/libnss_compat-2.3.2.so
> proftpd     899      ftp  mem       REG        9,1    33440
> 646574 /lib/tls/libnss_nis-2.3.2.so
> proftpd     899      ftp  mem       REG        9,1    13976
> 646571 /lib/tls/libnss_dns-2.3.2.so
> proftpd     899      ftp  mem       REG        9,1    64924
> 646578 /lib/tls/libresolv-2.3.2.so
> proftpd     899      ftp    0u     IPv4       2776                 TCP *:ftp
> (LISTEN)
> proftpd     899      ftp    1uW     REG        9,2     1056
> 670463 /var/run/proftpd/proftpd.scoreboard
> proftpd     899      ftp    4r      REG        9,1     1248
> 586047 /etc/group
>
> So, if it's a back door, it's really good at opening all the right files to
> look the the real thing.
>
> j

I think, that, the demon of proftpd make a problem, like a loop or a
overflow...:S

other command to kill the process other that suggest by Michael Marsh

killall -9 899

good night and good luck. I close.

heba