0

I am dealing with some essentially virus-like behavior that I'd like to end.

A task 'foo' is running on my computer, generating a lot of calls that are bringing my system performance to its knees. I can kill that task:

for i in `ps -x -U root | grep -i foo | cut -d' ' -f2`; do sudo kill -9 $i ; done

Unfortunately, an unknown task 'bar' is immediately re-launching foo. I have root access. I'm very tired of having my machine being disabled. How do i make this stop?

2 Answers 2

0

You can use cat /proc/{foo pid}/status | grep PPid to get the pid of the parent process. You can then use cat /proc/{bar pid}/cmdline to find out the command.

If it really happens to be a virus, you should perhaps entirely remove linux then reinstall it.

2
  • Unfortunately I'm running on a Mac, which doesn't have /proc. I found this: objectpark.net/en/parentpid.html and implemented it. it returns a value of 1, which is the pid for /sbin/launchd. Pretty sure that's not what I'm looking for :-( Commented Nov 12, 2021 at 20:50
  • 1
    From what I understand, launchd is a process manager so you can check which tasks are registered/scheduled and remove the one that you don't want. See launchd.info
    – æyno
    Commented Nov 12, 2021 at 22:35
0

The ps command can show you the parent pid in the PPID column. This will show you the process that started process "foo". You can then kill this PPID. Also the -C flag can select on process name.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .