1

We don't have any service running in the ubuntu but currently, we see the system becomes very slow from the morning,

When I tried top command, I see there are two new services running like below,

top - 11:34:11 up 14 days,  4:27,  2 users,  load average: 196.25, 196.95, 205.08
Tasks: 138 total,   2 running,  77 sleeping,   0 stopped,   0 zombie
%Cpu(s): 42.3 us,  2.3 sy,  0.0 ni,  0.0 id,  0.0 wa,  0.0 hi, 55.3 si,  0.0 st
KiB Mem :  8125684 total,  5043148 free,  2952856 used,   129680 buff/cache
KiB Swap:        0 total,        0 free,        0 used.  4967508 avail Mem

   PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
127090 test      20   0 2432756 2.287g   1508 S 200.0 29.5 615:13.56 kswapd0
 31462 test      20   0 5261204  74492   3272 S 200.0  0.9 132:10.43 tsm

Additional information :

 free -m
              total        used        free      shared  buff/cache   available
Mem:           7935        2887        4924           0         124        4848
Swap:             0           0           0

which takes too much of CPU and now I am not able to perform any command in the system,
Does anyone face this issue?

I already tried this : echo 3 > /proc/sys/vm/drop_caches but no luck,

Anyhelp is appreciated.

Thanks,
Harry

1 Answer 1

4

Your Linux workstation is infected with some malware, most likely some cryptominer.

In reality kswapd0 must always be a kernel/root process using zero VIRT/RES/SHR resources (because the kernel doesn't account its own usage in kernel threads) while your "kswapd0" is running under your user account.

I recommend that you reinstall everything from scratch (while wiping clean the entire disk, e.g. sudo tee < /dev/zero /dev/sda after you've backed up everything) because it's the only way to get rid of low level malware - even you boot loader might be compromised.

(To be completely safe, you'd better reflash your motherboard BIOS as well because modern malware is capable of infecting UEFI BIOS).

10
  • Indeed, also the real kswapd0, being a kernel process, would use 0 VIRT/RES/SHR (because kernel doesn't account its own usage in kernel threads). @Harry please also take a look at SF's "generic" Q/A about compromised systems: serverfault.com/questions/218005/…
    – A.B
    Jun 29, 2020 at 12:10
  • @Artem S. Tashkinov, I am using the azure machine : Its in cloud
    – Harry
    Jun 29, 2020 at 12:22
  • @Harry Then simply abandon this instance and create a new one. It would be great if you found out how you'd been hacked because it's quite serious. Jun 29, 2020 at 12:23
  • 1
    Your top output indicates you're running malware. The kswapd0 process is malware. I'm not sure why you're still asking questions. Jun 29, 2020 at 12:39
  • 2
    Probable malware's name: Outlaw. cryptomining, and also tsm is bruteforcing SSH: yoroi.company/research/… , oguzhantopgul.com/2020/06/…
    – A.B
    Jun 29, 2020 at 13:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .