3

Nowadays, my laptop frequently uses high %CPU (300%). I noticed that .dhpcd is involved in high %CPU. I could kill the process without any issue. However, it turns on automatically in about every 30 minutes. Strangely, the user is test in top (See the attached). I am wondering what it is, I would like to know how to fix or disable it completely (if it is okay). I am using ubuntu 16.04.5

The image is a capture from top while .dhpcd was on. screenshot of top

Improve this question
  • 2
    Did you install a dhcp server? – George Udosen Dec 12 '18 at 21:48
  • 1
    Hi donghoon. What ist the output of : sudo su test and then whicht .dhpcd ? – Boba Fit Dec 12 '18 at 21:58
  • Some sites seems to list that as a bad guy process. – Doug Smythies Dec 12 '18 at 21:59
  • 1
    Looks suspect - the name and resources are wrong. Could be a classic cryptominer (or other malware) masquerading as a system process. The REAL dhcp is a teeny little fellow that merely manages local IPV4 addresses. You can avoid malware like this by practicing safe computing habits. Removing it might be easy...or hard. – user535733 Dec 12 '18 at 23:11
  • 1
    I searched on google with linux ".dhpcd". I think it is malware and it is very new. – Doug Smythies Dec 14 '18 at 15:31
0

I am going to suggesting several things:

  1. Unplug your system from the internet and see if that process is still seen in the top window. If gone then perhpas some one or process installed by some one is using your CPU perhaps for data minning. Then which ever try the steps below.

  2. Search for it in:

    • cronjobs

      • sudo crontab -l: look for strange cronjobs
    • systemd services
      • sudo find / -iname "*dhpc*"

  3. Use top and ps:

    • top:

      1. Start top

      2. press f and use the arrow keys to move and select all the fields that have to do with user and/or userid or id in general. See screen shot below.

        enter image description here

      3. Use the spacebar to select the fields and the press q to quit.

        enter image description here

Now see what PPID, SUSER, RUSER, SUID says about that process. To trace the culprit.

Improve this answer
  • 1
    Shouldn't step 2 part 2 be *dhpc* instead of *dhcp*? – Doug Smythies Dec 14 '18 at 15:30
  • Yea your right let me update that! – George Udosen Dec 14 '18 at 15:38
  • @Doug Smythies, @George Udosen : Yes, I changed to *dhpc*. – donghoon Dec 14 '18 at 16:48
  • @George Udosen, By the way, .dhpcd did not start offline. As soon as I turn online, the process started. – donghoon Dec 14 '18 at 17:06
  • You created user test? – George Udosen Dec 14 '18 at 17:10
0

sudo crontab -l showed no crontab for root.

From sudo find / -iname "*dhpc*" , I found this: /home/test/.dhpcd

Also, the attached picture is capture from top. enter image description here

This is the result of `'ls -al': enter image description here

Quite a while ago, I created git page just for practice. Something fish is going on here..

Improve this answer
  • What is the content of .dhcpd? What is the content of sudo crontab -l -u test? Something is triggering it... – vidarlo Dec 14 '18 at 17:34
  • @vidarlo I just ran your command WITHOUT .dhpcd running. The output is 18 * * * * /home/test/.dhpcd -o ca.minexmr.com:4444 -t3 -B >/dev/null 2>/dev/null. I will run your command again after .dhpcd starts. – donghoon Dec 14 '18 at 17:50
  • While .dhpcd is running, the output is 18 * * * * /home/test/.dhpcd -o ca.minexmr.com:4444 -t3 -B >/dev/null 2>/dev/null It is actually the same..haha.. @vidalo , Do you have any more suggestion? Otherwise, I will delete the user test as George Udosen suggested. – donghoon Dec 14 '18 at 18:21
  • Best bet would be to remove the line from crontab (use crontab -e to edit), and verify other files such as .bashrc, and remove .dhcpd. – vidarlo Dec 14 '18 at 18:24
  • You have been compromised, and your computer is being used to mine crypto currency. Myself, I would delete the test user and all its files: sudo deluser --system --remove-all-files test. However, your system will still be suspect. – Doug Smythies Dec 14 '18 at 18:58
0

Thank you all for your help, especially, George Udosen and Doug Smythies.

Some of the most practical commands were:

top : To figure out which command was taking all my CPU; I found .dhpcd was using all my CPU. Note that it is different from dhcpcd.

Googling with linux ".dhpcd": To learn what it is...

sudo find / -iname "*dhpc*" : To figure out which directory contained .dhpcd.

sudo userdel -r test : To get rid of a user test. This was because .dhpcd was executed by a suspicious user called test.

sudo deluser --system --remove-all-files test : To remove all files created by a user test.

Finally I rebooted my laptop, and the issue has gone.

Note that I didn't remember if I had created the user test. Since I don't use the account, I deleted everything related to it. I do now know if the issue would have been resolved by deleting only .dhpcd.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.