Find the answer to your Linux question:
Results 1 to 3 of 3
HI Gurus, I am facing a security issue on my server. I can see many process like pscan2, scanssh and ./sshf processing on 'top'. The owner of these processes is ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. 07-31-2010 #1
    Xaeem
    Xaeem is offline
    Just Joined!
    Join Date
    Jul 2010
    Posts
    1

    Server infected with scanssh, pscan2, ./sshf. Urgent Help Required

    HI Gurus,

    I am facing a security issue on my server. I can see many process like pscan2, scanssh and ./sshf processing on 'top'. The owner of these processes is non root account. Can anybody let me know what can be the extent of loss due to these suspicious scripts? How can I permanently remove these scripts from my server. Please note that I am using CentOS 5.5 (64bit). Any help will be greatly appreciated.

    Regards,
    Sherazi
    Reply With Quote Reply With Quote
  2. 07-31-2010 #2
    Segfault
    Segfault is offline
    Linux Engineer Segfault's Avatar
    Join Date
    Jun 2008
    Location
    Acadiana
    Posts
    877
    So what account initiated these processes? If it is a legit user you have to kick his butt, if it is an unknown account you have to disconnect this server from net and reinstall from scratch.
    How To Ask Questions The Smart Way
    Reply With Quote Reply With Quote
  3. 08-02-2010 #3
    unspawn
    unspawn is offline
    Just Joined!
    Join Date
    Aug 2009
    Posts
    79
    Details here if he's slow responding ;-p
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules