Re: [tlug] Who is www-data, and why do they want my CPU?

["SL Baur" <steve@example.com>]

On 3/18/08, Dave M G <dave@example.com> wrote:

>  Next time it happens, I'll run:
>
> sudo find / -follow -type f -name www-data

No.  Do it now.  That's a simple find command, it doesn't require a running
process in order to work.

If the process is running, you can take a peek in /proc/PID where PID is the
process ID of www-data and look at the symlink to I believe `exe'.  If you have
/proc enabled.

If your machine has been pwned, the sooner you find out the better, so
please do that find now.

-sb