[CentOS] massive load caused by smartvd

[jwyeth.arch at gmail.com]

A quick Google for "smarvtd" returns results for both the smarvtd and whitptabil and they appear to be potential malware. Does a PS faux | grep smarvtd return a full path to the file that is running? How about top -c?

—
Sent from Mailbox

On Fri, Oct 3, 2014 at 9:35 PM, Tim Dunphy <bluethundr at gmail.com> wrote:

> Hey all,
>  I noticed that my puppet server running CentOS 6.5 was acting a little
> pokey.
>   So I logged in and did what well just about anyone would've done. And ran
> the uptime command to have a look at the load. And it was astonishingly
> high!
> [root at puppet:~] #uptime
>  21:28:01 up  1:26,  3 users,  load average: 107.37, 72.06, 75.52
> So then I had a look at top and saw a LOT of processes by the name of
> smartvd.
>  7332 root      20   0  423m 1808    0 S  5.6  0.1   0:49.30 smarvtd
>  5469 root      20   0  423m 1804    0 S  4.6  0.1   0:49.55 smarvtd
>  2042 root      20   0  423m 1804    0 S  3.7  0.1   0:49.66 smarvtd
>  2421 root      20   0  423m 1808    0 S  3.7  0.1   0:47.62 smarvtd
>  3081 root      20   0  423m 1808    0 S  3.7  0.1   0:47.08 smarvtd
>  3366 root      20   0  423m 1804    0 S  3.7  0.1   0:47.87 smarvtd
>  3568 root      20   0  423m 1808    0 S  3.7  0.1   0:48.94 smarvtd
>  3971 root      20   0  423m 1812    0 S  3.7  0.1   0:49.18 smarvtd
>  4264 root      20   0  423m 1812    0 S  3.7  0.1   0:48.33 smarvtd
>  4585 root      20   0  423m 1812    0 S  3.7  0.1   0:48.44 smarvtd
>  5277 root      20   0  423m 1808    0 S  3.7  0.1   0:48.13 smarvtd
>  6160 root      20   0  423m 1812    0 S  3.7  0.1   0:49.33 smarvtd
>  6441 root      20   0  423m 1808    0 S  3.7  0.1   0:48.17 smarvtd
>  6746 root      20   0  423m 1804    0 S  3.7  0.1   0:49.60 smarvtd
>  7612 root      20   0  423m 1812    0 S  3.7  0.1   0:48.97 smarvtd
>  7919 root      20   0  423m 1808    0 S  3.7  0.1   0:47.33 smarvtd
>  8202 root      20   0  423m 1812    0 S  3.7  0.1   0:49.67 smarvtd
> 26526 root      20   0  423m 1812    0 S  3.7  0.1   1:22.17 whitptabil
>  2747 root      20   0  423m 1812    0 S  2.8  0.1   0:48.41 smarvtd
>  4952 root      20   0  423m 1812    0 S  2.8  0.1   0:48.43 smarvtd
>  5878 root      20   0  423m 1808    0 S  2.8  0.1   0:48.02 smarvtd
>  7048 root      20   0  423m 1808    0 S  2.8  0.1   0:48.51 smarvtd
> So my question to you is what the HELL is smartvd ? Seems like a virus to
> me. And of course how do I get rid of it?
> Also curious what whitptabil is and how to get rid of it.
> I tried doing a search for both:
> [root at puppet:~] #rpm -qa | grep smartvd
> [root at puppet:~] #
> [root at puppet:~] #find / -name smartvd
> [root at puppet:~] #
> [root at puppet:~] #rpm -qa | grep whitptabil
> [root at puppet:~] #find / -name whitptabil
> /etc/whitptabil
> [root at puppet:~] #
> At least I found a file associated with the latter.
> Really really curious here, guys. What do y'all think???
> Thanks
> Tim
> -- 
> GPG me!!
> gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos