0

I have noticed in my 'indicator-multiload' application that my CPU usage some time after booting is raised permanently at about 50 to 100 percent. After running 'top' I can see a process owned by the user (not root) that consumes a lot of CPU that disappears after about 5 seconds. The process is sometimes called 'systemd' while other times is called 'gvfsd', 'initctl' or 'sleep'.

The strangest thing is that keeping terminal running 'top' prevents these processes from appearing again. If 'top' is terminated then after a while I can see a lot of CPU usage and re-running 'top' reveals that one of the above processes is running again (at high CPU).

systemd at high CPU usage: systemd at high CPU usage

sleep at high cpu usage: sleep at high cpu usage

Is this a normal behavior or is my system infected by some kind of a virus?

I am running Ubuntu 16.04 LTS with kernel 4.8.0-58-generic on a Gigabyte GA Z87X D3H with an Intel Dual Core and a Samsung 500GB SSD (no external drives, no proprietary drivers etc).

EDIT: Same situation here on Linux Mint 18.3 with both KDE and Xfce

1

I was also experiencing the same issues running latest Xubuntu LTE, updated.I also noted problems with my internet connection (DNS failures, low response). The offending task could have several names. There was (of course) a main task monitoring the system and reopening the CPU angry one. Running "top", even if renamed, made the child task kill itself. The only way to see the task running was through task manager. If you deleted the offending files they would reapear.

So... Grabbed my Holmes hat, my House cane, and this is what I have found.

This autostart file seems to have the code that makes the virus run at startup:

  • ~/.config/autostart/dbus-daemon.desktop

The exec code line:

Exec=/home/(your username)/.local/share/accounts/services/dbus-daemon

This files seems to have the code to make the virus gain privileges:

  • ~/.profile
  • ~/.bashrc
  • ~/.bash_profile

The code:

linux_bash="$HOME/(the path seems to be different, according to dissemination)"
if [ -e "$linux_bash" ];then
setsid "$linux_bash" 2>&1 & disown
fi

Since this files had a timestamp of 20:33, I searched for all files modified right after (there were a few more but I already deleted them for test purposes):

  • dom 20 jan 2019 20:33:19 WET ./.bash_profile
  • dom 20 jan 2019 20:33:19 WET ./.bashrc
  • dom 20 jan 2019 20:33:19 WET ./.config/autostart/dbus-daemon.desktop
  • dom 20 jan 2019 20:33:19 WET ./.profile
  • dom 20 jan 2019 20:33:19 WET ./.local/share/accounts/services/.dbus-daemon.bin
  • dom 20 jan 2019 20:33:19 WET ./.local/share/icc/.icc-daemon.bin
  • dom 20 jan 2019 20:33:19 WET ./.local/share/icc/.icc-daemon.log
  • dom 20 jan 2019 20:33:24 WET ./.kodi/addons/script.module.python.requests/lib/requests/packages/urllib3/connectionpool.py
  • dom 20 jan 2019 20:34:06 WET ./.local/share/accounts/services/.dbus-daemon.sys
  • dom 20 jan 2019 20:34:08 WET ./.local/share/icc/icc-daemon
  • dom 20 jan 2019 20:34:08 WET ./.local/share/icc/.icc-daemon.sys
  • dom 20 jan 2019 20:34:44 WET ./.local/share/accounts/services/dbus-daemon

The dissemination seems to create 3 files:

  • One timestamp
  • One base64 lookalike
  • The offending script

What I've done:

1- Deleted autostart file;

2- Delete offending code from ~/.profile, ~/.bashrc, ~/.bash_profile

3- Empty ~/.cache folder

4- Empty /tmp folder

5- Restarted

I don't know what this virus does. I did save the HEX file if someone wants to inspect any further. As I don't know how my machine got infected, (that Kodi urllib3 file looks suspicious!) I can't guarantee this is a final solution, though all seems OK now... I will keep my system in check the next few days to see if this was all there was.

I hope this helps someone. Forgive my poor English...


UPDATE

I have another machine running LibreElec, also infected.

0

I could not find out what was the problem so I created another user and problem does not exist on the new user. I also copied many of my files and settings including hidden folders except .config, .gconf, .gnome and problem still does not appear.

Maybe some bad settings, maybe some kind of a virus... Anyway, it was an issue only affecting the old user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.