I am trying to find out if someone is running a server on my Ubuntu without my knowledge











up vote
0
down vote

favorite












I know this sounds a bit odd. But I have been having hacking done on my computer and I am locked out of my "su" user now for some reason. My computer cpu is running abnormally high and I think there may be a server placed on my computer..call me paranoid. How can I tell if there is any server or high usage program put on my computer. I am a newbie in ubuntu so thanks for your understanding. :)



Ps I ran netstat as suggested in an ubuntu post..cant make heads or tails of it..










share|improve this question


















  • 2




    If you think someone else has your root password, then delete everything and reinstall now.
    – terdon
    Nov 29 at 13:30






  • 1




    What do you mean by "I have been having hacking done on my computer?" If you are wondering if your system has been compromised, then now is the WRONG time to try to learn the skills. Follow @terdon's advice right now.
    – user535733
    Nov 29 at 13:39















up vote
0
down vote

favorite












I know this sounds a bit odd. But I have been having hacking done on my computer and I am locked out of my "su" user now for some reason. My computer cpu is running abnormally high and I think there may be a server placed on my computer..call me paranoid. How can I tell if there is any server or high usage program put on my computer. I am a newbie in ubuntu so thanks for your understanding. :)



Ps I ran netstat as suggested in an ubuntu post..cant make heads or tails of it..










share|improve this question


















  • 2




    If you think someone else has your root password, then delete everything and reinstall now.
    – terdon
    Nov 29 at 13:30






  • 1




    What do you mean by "I have been having hacking done on my computer?" If you are wondering if your system has been compromised, then now is the WRONG time to try to learn the skills. Follow @terdon's advice right now.
    – user535733
    Nov 29 at 13:39













up vote
0
down vote

favorite









up vote
0
down vote

favorite











I know this sounds a bit odd. But I have been having hacking done on my computer and I am locked out of my "su" user now for some reason. My computer cpu is running abnormally high and I think there may be a server placed on my computer..call me paranoid. How can I tell if there is any server or high usage program put on my computer. I am a newbie in ubuntu so thanks for your understanding. :)



Ps I ran netstat as suggested in an ubuntu post..cant make heads or tails of it..










share|improve this question













I know this sounds a bit odd. But I have been having hacking done on my computer and I am locked out of my "su" user now for some reason. My computer cpu is running abnormally high and I think there may be a server placed on my computer..call me paranoid. How can I tell if there is any server or high usage program put on my computer. I am a newbie in ubuntu so thanks for your understanding. :)



Ps I ran netstat as suggested in an ubuntu post..cant make heads or tails of it..







server netstat hacking






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Nov 29 at 13:01









JayCouture.com

158119




158119








  • 2




    If you think someone else has your root password, then delete everything and reinstall now.
    – terdon
    Nov 29 at 13:30






  • 1




    What do you mean by "I have been having hacking done on my computer?" If you are wondering if your system has been compromised, then now is the WRONG time to try to learn the skills. Follow @terdon's advice right now.
    – user535733
    Nov 29 at 13:39














  • 2




    If you think someone else has your root password, then delete everything and reinstall now.
    – terdon
    Nov 29 at 13:30






  • 1




    What do you mean by "I have been having hacking done on my computer?" If you are wondering if your system has been compromised, then now is the WRONG time to try to learn the skills. Follow @terdon's advice right now.
    – user535733
    Nov 29 at 13:39








2




2




If you think someone else has your root password, then delete everything and reinstall now.
– terdon
Nov 29 at 13:30




If you think someone else has your root password, then delete everything and reinstall now.
– terdon
Nov 29 at 13:30




1




1




What do you mean by "I have been having hacking done on my computer?" If you are wondering if your system has been compromised, then now is the WRONG time to try to learn the skills. Follow @terdon's advice right now.
– user535733
Nov 29 at 13:39




What do you mean by "I have been having hacking done on my computer?" If you are wondering if your system has been compromised, then now is the WRONG time to try to learn the skills. Follow @terdon's advice right now.
– user535733
Nov 29 at 13:39










2 Answers
2






active

oldest

votes

















up vote
4
down vote













top should allow you to see processes currently running and you can order them by cpu / memory usage.




  • run top


  • press z and then x to see current sort column highlighted


  • press > to navigate to CPU column



now you have processes ordered by CPU usage, see if there's anything suspicious






share|improve this answer






























    up vote
    1
    down vote













    If you believe that your system has been compromised:




    1. Take it offline RIGHT NOW.

    2. If you are a skilled user, and wish to conduct a detailed forensic investigation at leisure, then clone the drive.

    3. Do a clean-install of Ubuntu. Format the disk - delete everything and start fresh.

    4. Restore your data from backups taken before the suspected intrusion occurred.






    share|improve this answer





















      Your Answer








      StackExchange.ready(function() {
      var channelOptions = {
      tags: "".split(" "),
      id: "89"
      };
      initTagRenderer("".split(" "), "".split(" "), channelOptions);

      StackExchange.using("externalEditor", function() {
      // Have to fire editor after snippets, if snippets enabled
      if (StackExchange.settings.snippets.snippetsEnabled) {
      StackExchange.using("snippets", function() {
      createEditor();
      });
      }
      else {
      createEditor();
      }
      });

      function createEditor() {
      StackExchange.prepareEditor({
      heartbeatType: 'answer',
      convertImagesToLinks: true,
      noModals: true,
      showLowRepImageUploadWarning: true,
      reputationToPostImages: 10,
      bindNavPrevention: true,
      postfix: "",
      imageUploader: {
      brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
      contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
      allowUrls: true
      },
      onDemand: true,
      discardSelector: ".discard-answer"
      ,immediatelyShowMarkdownHelp:true
      });


      }
      });














      draft saved

      draft discarded


















      StackExchange.ready(
      function () {
      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1097115%2fi-am-trying-to-find-out-if-someone-is-running-a-server-on-my-ubuntu-without-my-k%23new-answer', 'question_page');
      }
      );

      Post as a guest















      Required, but never shown

























      2 Answers
      2






      active

      oldest

      votes








      2 Answers
      2






      active

      oldest

      votes









      active

      oldest

      votes






      active

      oldest

      votes








      up vote
      4
      down vote













      top should allow you to see processes currently running and you can order them by cpu / memory usage.




      • run top


      • press z and then x to see current sort column highlighted


      • press > to navigate to CPU column



      now you have processes ordered by CPU usage, see if there's anything suspicious






      share|improve this answer



























        up vote
        4
        down vote













        top should allow you to see processes currently running and you can order them by cpu / memory usage.




        • run top


        • press z and then x to see current sort column highlighted


        • press > to navigate to CPU column



        now you have processes ordered by CPU usage, see if there's anything suspicious






        share|improve this answer

























          up vote
          4
          down vote










          up vote
          4
          down vote









          top should allow you to see processes currently running and you can order them by cpu / memory usage.




          • run top


          • press z and then x to see current sort column highlighted


          • press > to navigate to CPU column



          now you have processes ordered by CPU usage, see if there's anything suspicious






          share|improve this answer














          top should allow you to see processes currently running and you can order them by cpu / memory usage.




          • run top


          • press z and then x to see current sort column highlighted


          • press > to navigate to CPU column



          now you have processes ordered by CPU usage, see if there's anything suspicious







          share|improve this answer














          share|improve this answer



          share|improve this answer








          edited Nov 29 at 13:31









          singrium

          905218




          905218










          answered Nov 29 at 13:04









          janmyszkier

          50827




          50827
























              up vote
              1
              down vote













              If you believe that your system has been compromised:




              1. Take it offline RIGHT NOW.

              2. If you are a skilled user, and wish to conduct a detailed forensic investigation at leisure, then clone the drive.

              3. Do a clean-install of Ubuntu. Format the disk - delete everything and start fresh.

              4. Restore your data from backups taken before the suspected intrusion occurred.






              share|improve this answer

























                up vote
                1
                down vote













                If you believe that your system has been compromised:




                1. Take it offline RIGHT NOW.

                2. If you are a skilled user, and wish to conduct a detailed forensic investigation at leisure, then clone the drive.

                3. Do a clean-install of Ubuntu. Format the disk - delete everything and start fresh.

                4. Restore your data from backups taken before the suspected intrusion occurred.






                share|improve this answer























                  up vote
                  1
                  down vote










                  up vote
                  1
                  down vote









                  If you believe that your system has been compromised:




                  1. Take it offline RIGHT NOW.

                  2. If you are a skilled user, and wish to conduct a detailed forensic investigation at leisure, then clone the drive.

                  3. Do a clean-install of Ubuntu. Format the disk - delete everything and start fresh.

                  4. Restore your data from backups taken before the suspected intrusion occurred.






                  share|improve this answer












                  If you believe that your system has been compromised:




                  1. Take it offline RIGHT NOW.

                  2. If you are a skilled user, and wish to conduct a detailed forensic investigation at leisure, then clone the drive.

                  3. Do a clean-install of Ubuntu. Format the disk - delete everything and start fresh.

                  4. Restore your data from backups taken before the suspected intrusion occurred.







                  share|improve this answer












                  share|improve this answer



                  share|improve this answer










                  answered Nov 29 at 13:36









                  user535733

                  7,33422941




                  7,33422941






























                      draft saved

                      draft discarded




















































                      Thanks for contributing an answer to Ask Ubuntu!


                      • Please be sure to answer the question. Provide details and share your research!

                      But avoid



                      • Asking for help, clarification, or responding to other answers.

                      • Making statements based on opinion; back them up with references or personal experience.


                      To learn more, see our tips on writing great answers.





                      Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


                      Please pay close attention to the following guidance:


                      • Please be sure to answer the question. Provide details and share your research!

                      But avoid



                      • Asking for help, clarification, or responding to other answers.

                      • Making statements based on opinion; back them up with references or personal experience.


                      To learn more, see our tips on writing great answers.




                      draft saved


                      draft discarded














                      StackExchange.ready(
                      function () {
                      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1097115%2fi-am-trying-to-find-out-if-someone-is-running-a-server-on-my-ubuntu-without-my-k%23new-answer', 'question_page');
                      }
                      );

                      Post as a guest















                      Required, but never shown





















































                      Required, but never shown














                      Required, but never shown












                      Required, but never shown







                      Required, but never shown

































                      Required, but never shown














                      Required, but never shown












                      Required, but never shown







                      Required, but never shown







                      Popular posts from this blog

                      數位音樂下載

                      When can things happen in Etherscan, such as the picture below?

                      格利澤436b