My linux server was hacked. and now there is a file in root directory that generates big traffic. when i kill this process it autostarts itself again. then i did chmod -x. but it returned x option.there is no crontab job. i have installed auditd to check what is going on. but i cannot find how it autostarts itself?and maybe some other processes (daemons) work there to autostart it. how can i trace the daemons activity that starts this process?thanks.
Process auto starts itself not by cron
linux;process
Take the machine offline, i.e. unplug the network cable, shut it down, boot from a live medium and make an image of it. Or, if you're able to, image it while running. You can do the forensics later using the appropriate tools, I'd go with DEFT: www.deftlinux.net 