1

I have a - what I think Malware - problem on my site. Using my server to send spam mail. When running top and SHIFT+M I get the following:

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                                          
 4282 postfix   20   0 63368  37m 1496 S    2  3.6   0:07.44 qmgr                                                                                                                              
 3558 mysql     20   0 1024m  26m 7736 S    0  2.6   0:04.28 mysqld                                                                                                                            
 4156 www-data  20   0  323m  20m 3900 S    0  2.0   0:00.41 apache2                                                                                                                           
 2846 www-data  20   0  323m  20m 3964 S    0  2.0   0:01.14 apache2                                                                                                                           
 1578 www-data  20   0  322m  19m 4000 S    0  1.9   0:01.39 apache2                                                                                                                           
 1896 www-data  20   0  320m  17m 3956 S    0  1.7   0:01.25 apache2                                                                                                                           
 4160 www-data  20   0  319m  16m 3948 S    0  1.6   0:00.29 apache2                                                                                                                           
 4599 www-data  20   0  319m  16m 3752 S    0  1.6   0:00.12 apache2                                                                                                                           
  666 www-data  20   0  319m  16m 3948 S    0  1.6   0:01.26 apache2                                                                                                                           
 2366 www-data  20   0  317m  13m 3976 S    0  1.4   0:01.19 apache2                                                                                                                           
 3545 www-data  20   0  316m  13m 3912 S    0  1.4   0:00.34 apache2                                                                                                                           
  654 root      20   0  309m 8436 6428 S    0  0.8   0:00.06 apache2                                                                                                                           
 1918 www-data  20   0  320m 7092 3972 S    0  0.7   0:00.74 apache2                                                                                                                           
 4335 postfix   20   0  115m 2904 2012 S    0  0.3   0:01.15 proxymap                                                                                                                          
 4386 postfix   20   0 44308 2888 2212 S    0  0.3   0:00.07 smtp                                                                                                                              
 2751 root      20   0 73316 2876 2752 S    0  0.3   0:00.07 sshd                                                                                                                              
 4349 postfix   20   0 44296 2872 2200 S    0  0.3   0:00.04 smtp                                                                                                                              
 4285 postfix   20   0  115m 2852 2008 S    0  0.3   0:00.74 proxymap                                                                                                                          
 4317 postfix   20   0 44320 2848 2212 S    0  0.3   0:00.05 smtp                                                                                                                              
 4292 postfix   20   0 44188 2836 2212 S    0  0.3   0:00.07 smtp                                                                                                                              
 4298 postfix   20   0 44188 2836 2212 S    0  0.3   0:00.07 smtp                                                                                                                              
 4327 postfix   20   0 44188 2836 2212 S    0  0.3   0:00.08 smtp                                                                                                                              
 4332 postfix   20   0 44296 2836 2212 S    0  0.3   0:00.05 smtp                                                                                                                              
 4355 postfix   20   0 44188 2836 2212 S    0  0.3   0:00.04 smtp                                                                                                                              
 4356 postfix   20   0 44300 2836 2212 S    0  0.3   0:00.09 smtp                                                                                                                              
 4375 postfix   20   0 44188 2836 2212 S    0  0.3   0:00.09 smtp                                                                                                                              
 4387 postfix   20   0 44188 2836 2212 S    0  0.3   0:00.06 smtp                                                                                                                              
 4388 postfix   20   0 44188 2836 2212 S    0  0.3   0:00.05 smtp                                                                                                                              
 4394 postfix   20   0 44188 2836 2212 S    0  0.3   0:00.08 smtp                                                                                                                              
 4405 postfix   20   0 44188 2836 2212 S    0  0.3   0:00.08 smtp                                                                                                                              
 4300 postfix   20   0 44188 2832 2212 S    0  0.3   0:00.05 smtp                                                                                                                              
 4303 postfix   20   0 44304 2832 2212 S    0  0.3   0:00.08 smtp                                                                                                                              
 4304 postfix   20   0 44188 2832 2208 S    0  0.3   0:00.05 smtp                                                                                                                              
 4314 postfix   20   0 44188 2832 2212 S    0  0.3   0:00.06 smtp                                                                                                                              
 4340 postfix   20   0 44188 2832 2212 S    0  0.3   0:00.02 smtp                                                                                                                              
 4357 postfix   20   0 44188 2832 2208 S    0  0.3   0:00.04 smtp                                                                                                                              
 4373 postfix   20   0 44188 2832 2212 S    0  0.3   0:00.08 smtp                                                                                                                              
 4379 postfix   20   0 44188 2832 2212 S    0  0.3   0:00.04 smtp                                                                                                                              
 4389 postfix   20   0 44188 2832 2212 S    0  0.3   0:00.02 smtp                                                                                                                              
 4293 postfix   20   0 44188 2828 2208 S    0  0.3   0:00.07 smtp                                                                                                                              
 4295 postfix   20   0 44188 2828 2208 S    0  0.3   0:00.09 smtp                                                                                                                              
 4306 postfix   20   0 44188 2828 2212 S    0  0.3   0:00.04 smtp                                                                                                                              
 4318 postfix   20   0 44188 2828 2212 S    0  0.3   0:00.02 smtp                                                                                                                              
 4320 postfix   20   0 44188 2828 2208 S    0  0.3   0:00.06 smtp                                                                                                                              
 4331 postfix   20   0 44188 2828 2208 S    0  0.3   0:00.07 smtp                                                                                                                              
 4364 postfix   20   0 44188 2828 2212 S    0  0.3   0:00.05 smtp                                                                                                                              
 4369 postfix   20   0 44188 2828 2208 S    0  0.3   0:00.05 smtp                                                                                                                              
 4374 postfix   20   0 44188 2828 2212 S    0  0.3   0:00.04 smtp                                                                                                                              
 4395 postfix   20   0 44188 2828 2212 S    0  0.3   0:00.06 smtp                                                                                                                              
 4399 postfix   20   0 44188 2828 2208 S    0  0.3   0:00.06 smtp                                                                                                                              
 4299 postfix   20   0 44188 2824 2208 S    0  0.3   0:00.07 smtp  

How can I find which file is executing postfix?
My system is Debian, Apache2, MySQL

  • 2
    Rather than malware, I would suspect that you are hosting a form that sends mail. – jordanm Apr 21 '13 at 15:38
2

In order to track this stuff down, you need some sort of auditing enabled when it happens. You can either do process accounting (hardly ever useful in my experience) or configure auditd to audit for system calls like execve.

Once the event is logged by auditd, you can find the execve or fork for the binary in question and just trace it back to a particular shell or script. It may trace back to the service files though. If an attacker is manually starting the postfix service from the command line it will tell you what username they first logged into the system as and from where (console, hostname of remote system, etc).

This answer over on SF does a good job of introducing you to auditd. Most auditd users seem to be RHEL so if you google it you'll run across a lot of RHEL-centric information but a lot of the skill set is transferable between distros obviously.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.