Prozesse indentifizieren

U

user_001

Registered User
Hallo,

Könnte mir jemand vielleicht sagen, welche diese Prozesse möglicherweise schädlich oder ne hinweis auf Virus ...etc sein kann.
habe mir alle prozesse auf dem Server zeigen lassen, wei folgt:
Code: 
UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 May29 ?        00:00:06 init [3]
root         2     1  0 May29 ?        00:00:00 [keventd]
root         3     1  0 May29 ?        00:00:00 [ksoftirqd_CPU0]
root         4     1  0 May29 ?        00:00:18 [kswapd]
root         5     1  0 May29 ?        00:00:00 [bdflush]
root         6     1  0 May29 ?        00:00:00 [kupdated]
root         9     1  0 May29 ?        00:00:00 [khubd]
root        10     1  0 May29 ?        00:39:12 [kjournald]
root        55     1  0 May29 ?        00:00:00 [kjournald]
root       434     1  0 May29 ?        00:00:00 /sbin/dhcpcd -H -D -N -t 999999 -h linux eth0
root       501     1  0 May29 ?        00:42:22 /sbin/syslogd -a /var/lib/named/dev/log
root       504     1  0 May29 ?        00:00:01 /sbin/klogd -c 1 -2
root       514     1  0 May29 ?        00:00:00 /usr/sbin/saslauthd -a pam
root       515   514  0 May29 ?        00:00:00 /usr/sbin/saslauthd -a pam
root       516   514  0 May29 ?        00:00:00 /usr/sbin/saslauthd -a pam
root       517   514  0 May29 ?        00:00:00 /usr/sbin/saslauthd -a pam
root       518   514  0 May29 ?        00:00:00 /usr/sbin/saslauthd -a pam
bin        528     1  0 May29 ?        00:00:00 /sbin/portmap
root       567     1  0 May29 ?        00:00:15 /usr/sbin/xinetd
root       573     1  0 May29 ?        00:00:00 /bin/sh /usr/bin/mysqld_safe --user=mysql --pid-file=/var/lib/mysql/mysqld.pid --socket=/var/lib/mysql/mysql.s
root       603     1  0 May29 ?        00:01:49 /usr/sbin/sshd -o PidFile=/var/run/sshd.init.pid
mysql      620   573  0 May29 ?        00:06:02 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/mysqld.pid --s
root       621     1  0 May29 ?        00:00:00 /sbin/startpar -f -- /etc/init.d/rc3.d/S12named
named      629     1  0 May29 ?        00:00:00 /usr/sbin/named -t /var/lib/named -u named
named      630   629  0 May29 ?        00:00:00 /usr/sbin/named -t /var/lib/named -u named
named      631   630  0 May29 ?        00:00:00 /usr/sbin/named -t /var/lib/named -u named
named      632   630  0 May29 ?        00:00:00 /usr/sbin/named -t /var/lib/named -u named
named      633   630  0 May29 ?        00:00:00 /usr/sbin/named -t /var/lib/named -u named
mysql      642   620  0 May29 ?        00:03:44 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/mysqld.pid --s
mysql      643   642  0 May29 ?        00:22:16 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/mysqld.pid --s
root       803     1  0 May29 ?        01:20:20 /usr/lib/postfix/master
root       871     1  0 May29 ?        00:02:36 /usr/sbin/nscd
root       872     1  0 May29 ?        00:05:35 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
root       873   871  0 May29 ?        00:00:00 /usr/sbin/nscd
root       874   873  0 May29 ?        00:02:32 /usr/sbin/nscd
root       875   873  0 May29 ?        00:00:07 /usr/sbin/nscd
root       877   873  0 May29 ?        00:00:07 /usr/sbin/nscd
root       878     1  0 May29 ?        00:00:00 /usr/sbin/cron
root       879   873  0 May29 ?        00:00:06 /usr/sbin/nscd
root       880   873  0 May29 ?        00:00:06 /usr/sbin/nscd
root       882     1  0 May29 tty1     00:00:00 /sbin/mingetty --noclear tty1
root       883     1  0 May29 tty2     00:00:00 /sbin/mingetty tty2
root       884     1  0 May29 tty3     00:00:00 /sbin/mingetty tty3
root       885     1  0 May29 tty4     00:00:00 /sbin/mingetty tty4
root       886     1  0 May29 tty5     00:00:00 /sbin/mingetty tty5
root       887     1  0 May29 tty6     00:00:00 /sbin/mingetty tty6
root       888     1  0 May29 ttyS0    00:00:00 /sbin/agetty -L 57600 ttyS0 vt102
postfix   1308   803  0 May29 ?        00:25:27 qmgr -l -t fifo -u
wwwrun    3078   872  0 Jun19 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    3233   872  0 Jun19 ?        00:00:01 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    4039   872  0 Jul21 ?        00:01:13 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    5225   872  0 Jul21 ?        00:00:30 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   19491   872  0 Jul24 ?        00:00:35 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   19492   872  0 Jul24 ?        00:00:34 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   19721   872  0 Jul24 ?        00:00:30 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   19928   872  0 Jul24 ?        00:00:32 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   28225   872  0 Jul26 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   28273   872  0 Jul26 ?        00:00:02 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   29352   872  0 Jul26 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   29354   872  0 Jul26 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    5231   872  0 Aug07 ?        00:00:01 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    5966   872  0 Sep06 ?        00:00:02 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    5968   872  0 Sep06 ?        00:00:02 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6108   872  0 Sep06 ?        00:00:01 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6191   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6192   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6218   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6236   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6237   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6238   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6291   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6292   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6296   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6297   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6299   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    6313   872  0 Sep06 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    3986   872  0 Sep18 ?        00:00:05 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
root     16796   872  0 Oct06 ?        00:00:21 /usr/bin/perl /root/confixx/pipelog.pl
wwwrun   31017   872  0 01:13 ?        00:00:07 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   31096   872  0 01:19 ?        00:00:09 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   31877   872  0 02:29 ?        00:00:05 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   32064   872  0 02:50 ?        00:00:03 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
postfix  32070   803  0 02:51 ?        00:00:00 pickup -l -t fifo -u
wwwrun   32119   872  0 02:59 ?        00:00:04 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
mysql    32164   642  0 03:03 ?        00:00:00 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/mysqld.pid --s
wwwrun   32189   872  0 03:07 ?        00:00:05 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   32194   872  0 03:07 ?        00:00:02 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   32198   872  0 03:07 ?        00:00:01 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   32437   872  0 03:41 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   32561   872  0 03:51 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
root     32583   603  0 03:53 ?        00:00:00 sshd: root@pts/0
root     32584 32583  0 03:53 ?        00:00:00 sshd: root@pts/0
root     32587 32583  0 03:53 pts/0    00:00:00 -bash
root     32605   878  0 03:54 ?        00:00:00 [cron] <defunct>
root     32608 32587  0 03:54 pts/0    00:00:00 ps -ef

Danke
 
viel Dank für die Antwort!
wie könnte ich nun heraus finden, ob irgendwelche unerwünschte Prozesse oder aktivitäten auf dem Server läuft?

wenn da welche wäre, wie könnte ich sie beenden?
irgenwas mit kill oder so :-)
der server läuft auf suse.9.3 und admintool confixx.


Danke
 
Last edited by a moderator:
Hallo,

Code: 
kill <PID>

Bezüglich der anderen Frage.
Zum einen in der Prozessliste :
Code: 
ps aux

Zum anderen in diversen Logdateien, zu finden unter :
Code: 
/var/log/

Das sind zumindest meine Vorschläge.
 
user_001 said:
wie könnte ich nun heraus finden, ob irgendwelche unerwünschte Prozesse oder aktivitäten auf dem Server läuft?
Click to expand...

Als Admin eines Servers sollte man seine laufenden Prozesse alle kennen.
Taucht dann doch plötzlich ein unbekannter Prozess auf, heißts dann halt erstmal "googlen" um zu schauen was der Prozess überhaupt ist/macht bzw. Prozess killen.
 
You must log in or register to reply here.
Back
Top