8

I have this small virtual server (1GB RAM, 1 vcore), which served me well untill it suddenly started reporting 100% CPU usage because of kswapd0. Memory consumption is between 50% and 60%. I've set swappiness to 0 just to check if it releases CPU resources, but it did not. I've had this issue on 16.04, and now on 18.04 after upgrade. How to get rid of this kswapd0 CPU hog?

2
  • Confirming this issue with my server too (Ubuntu 18.04). At least the malware was not running from root but some other user. On this server I have samba; most of users are on Windows machines. The infected user (on Linux) was the account of the least computer-stuff-aware person. After disabling the user and rebooting, the issue stopped. Edit: I observed things on my server as described on this article: laptrinhx.com/… May 5, 2021 at 17:11
  • More Info in case you have been hacked for bitcoin mining. See reddit.com/r/valheim/comments/zltnqb/… Jan 17, 2023 at 9:14

4 Answers 4

18

In case someone faces the same issues - the reason was malware: Multios.Coinminer.Miner.

kswapd0 was a binary file located in /root/.configrc/a/kswapd0. What you need to do is:

  1. Clear crontab jobs referring to /root/.configrc
  2. Clear ssh keys
  3. Delete /root/.configrc
5
  • 2
    Malware link is malicious - please DO NOT share malware samples.
    – Thomas Ward
    Apr 21, 2020 at 14:05
  • 1
    Got hit by this. Thanks for the info
    – Dave
    Aug 4, 2020 at 2:08
  • 1
    I knew something was dodgy when the commandline shows "./kswapd". Thanks :)
    – Shadow
    Oct 28, 2020 at 4:15
  • +1. In my case when running top the user was installer+
    – Ben Arent
    Feb 20, 2022 at 7:52
  • Had the same issue. But got in as a tomcat6 user
    – Des Magner
    Mar 24 at 10:53
3

This is also relevant for 20.04. I caught from a Steam user adding content to the KillingFloor2 Dedicated server. Here's what it looks like.

Results of crontab -e:

crontab -e

Results of htop:

htop

How to solve this problem:

  1. I commented lines in the cronjob
  2. Rebooted the server (CPU calmed down)
  3. Deleted the .configrc folder
  4. Checked again the paths of the crown and cleared it.
1
2

Malware running as guest

If you have ever enabled Ubuntu's guest account and later enabled SSH, you may have malware running using your guest account.

sudo find /home -f kswapd0

It can be found in any user's home directory, such as /home/guest/.configrc/

Joining any network (conference, cafe, city) that has a compromised machine, or if you use a service like ngrok, all while having SSH open on your system leaves your computer exposed to this simple guest vulnerability.

Because privileges were never elevated (guest can't write files outside /home/guest, nor sudo without password), I was able to delete the guest account and everything is running normally.

1
  • in my case it was malware running as dev
    – fanbondi
    Mar 7, 2023 at 22:17
2

I changed swappiness from 60 to 0, but it didn't work. According to the answer from Paul, I found VIRT/RES/SHR non-zero for those CPU-hungry kswapd0 tasks, suggesting the existence of malwares.

Recent updates on similar questions also show the existence of malwares that hide as kswapd0:

  1. kswapd0 is taking a lot of cpu
  2. kswapd0 in ubuntu slows down the system
  3. 记录被kswapd0这个挖矿病毒折磨的一天

Below is my solution. (Please use sudo, killall, rm -rf carefully)

  1. Find where the fake kswapd0 is.
$ sudo find /home -name kswapd0
/home/user/.configrc5/a/kswapd0
  1. Since the new server has few accounts, I double-checked that nobody is using this account, and the .configrc5 folder is relatively new (created in about one week).
$ sudo ls /home/user -al
total 224
drwxr-xr-x 18 user user   4096  四  10 23:56 .
drwxr-xr-x  8 root root   4096  四  10 20:44 ..
-rw-r--r--  1 user user    220  一  13 09:10 .bash_logout
-rw-r--r--  1 user user   3771  一  13 09:10 .bashrc
drwxrwxr-x 14 user user   4096  二  10 17:40 .cache
drwx------ 12 user user   4096  二  24 15:09 .config
drwxrwxr-x  4 user user   4096  四   4 00:48 .configrc5
...
-rw-r--r--  1 root root 131953  二  26 23:34 plm
-rw-r--r--  1 root root   6300  二  26 23:34 plm2
-rw-r--r--  1 user user    807  一  13 09:10 .profile
drwxr-xr-x  2 user user   4096  一  13 09:34 Public
drwx------  3 user user   4096  二  10 16:09 snap
drwx------  2 user user   4096  四  10 23:56 .ssh
-rw-r--r--  1 user user      0  一  13 09:51 .sudo_as_admin_successful
drwxr-xr-x  2 user user   4096  一  13 09:34 Templates
drwxr-xr-x  2 user user   4096  一  13 09:34 Videos
  1. (Can skip) I thought I could kill the user account once and for all, and check that it had sudo privilege, but sudo userdel user is rejected.
  2. Kill all the processes run by user
$ sudo killall -u user
  1. Remove all files under .configrc5
$ sudo rm -rf /home/user/.configrc5
  1. Check htop again and no strange CPU activities anymore.
5
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Apr 10, 2023 at 17:45
  • There was already a given and accepted and proven to work answer. It was not this complex. Your answer does not help and is way more complex then it needs to be.
    – David
    Apr 11, 2023 at 7:46
  • I acknowledged the first answers. However, they didn't solve the problem for me. Bozeman's answer helped me find the location of the fake kswapd0, but the command "-f" didn't work. Vaflan and "m m" mentioned crontab, but I found nothing in my crontab. I was not sure if clearing ssh keys will affect anything, but this kswapd0 did come back today. Besides all, I am curious what is more complex and what does not help for you, so that I can improve. Apr 21, 2023 at 10:23
  • I found '.configrc5' by silversearcher-ag in the file $/var/spool/cron/crontabs/user$ , which seems to be basic knowledge for crontab users. The command $crontab -u user -r$ removes the file. Apr 21, 2023 at 17:36
  • There are some more files to clean according to blog.csdn.net/tianli0929/article/details/115108987 For me, dota3.tar.gz is located under /tmp/.X2kzz, and I also had to remove /home/user/.ssh/authorized_keys. May 16, 2023 at 7:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .