We have been experiencing high load issues on our Linux server recently. Upon checking with the
top
command, we noticed an unknown process with a garbled command name (as shown in following images, notice that the command name would change after rebooting). This process is consuming a significant amount of CPU resources.
We attempted to locate the executable path of this suspicious process, and the server returned the result shown in Image 4. The path indicates that the executable file has been deleted:
/proc/4747/exe -> '/ac1e4262 (deleted)'
From what I understand, this could mean that the process is still running even though its executable file has been removed. This situation might be indicative of a Trojan or other malicious activity.
My Questions:
- Is this high CPU usage by an unknown process with a garbled command name likely caused by a Trojan or some other form of malware?
- What steps should I take to investigate and resolve this issue to ensure the security and stability of our server?