On Mon, 2003-11-17 at 22:14, Alan wrote: > > When I ran TOP, I found a root session was running nano - at 50% CPU - > > continuously. This session would have survived at least 3 reboots. > > > > This system is behind my firewall and I have no reason to think it has > > been hacked.....and why would nano be using 50% of the CPU anyway? > > I've seen vim do this as well occassionaly. Every once and a while an > app will just start spinning and kill off your CPU with it. However, > I highly doubt that it survived 3 reboots without being restarted > somehow. After a reboot, running apps die, so if it was running again > it was started somehow I'd think.
That's what I thought....but when i first noticed Seti effectively running at 50% of capacity, I thought it might be some sort of racing kernel issue.....and I re-booted the system for a couple of days to se if it made any difference. It didn't appear to. I did not run TOP....probably because it was late. I usually check the "seti farm" just before going to bed. I then checked to see if the KDE screen saver was interfering. I usually have it set to low CPU and a blank screen only. That looked perfectly normal. Finally....running TOP occurred to me and when I did, I saw a root session running nano....and i could not recall having logged in as root and run nano any time in the past few days. But I can't rule it out as I almost certainly would have adjusted the host name of the local portage mirror when the operator changed it. But when cycled through the various terminals, I was not connected to any login session.....whatever it was, was running in the background. > Do I have a clue how? Nope, not one. Does it show up in a ps after a > reboot? Or if you check periodically? I will. :-) -- Steve Withers <[EMAIL PROTECTED]> -- [EMAIL PROTECTED] mailing list
