I have a process named "stealth" that has infected my server (slamming my CPU) and I can't figure out where it is to remove it for good. Everytime I kill the process it somehow starts itself again...
ps -ef | grep stealth gives me this:
But I have no idea where ./stealth would be since it's a relative path?
Also when I try using locate or find, I get nothing.
Any ideas how I can find and remove this process?
I'm running a personal ssh server on a nonstandard port. If someone tries to log into my ssh server thru the standard port 22, it seems that the server sends "Connection refused" message.
$ ssh localhost
ssh: connect to host localhost port 22: Connection refused
How can I make it so that it doesn't send such message and it behaves like it's not running?
I was reading a website about the difference between stealthed and closed ports.
http://www.grc.com/faq-shieldsup.htm
A closed port will echo a packet if closed. However, a stealthed port will not respond at all.
Is it recommended to stealth all the ports you don't use? If so, how do you go about doing so?