CPU使用率非常高但是无法找到具体进程
发布时间：2025-10-10 15:26:13.33 文章来源：AiSoftCloud 浏览次数：152 下载次数：1 

系统CPU使用率非常高但是无法找到具体进程问题

问题现象

系统CPU使用非常高，达到1200%，但是使用top/htop等工具无法看到具体什么进程使系统CPU占用很高，如下图所示：

问题原因

这种情况是因为有隐藏进程存在，但是top、htop等工具看不到，需要找到具体的隐藏进程
相关工具：unhide，使用如下命令安装： 

  1. sudo apt install unhide

排查原因

  1. sudo unhide proc

结果如下：

  1. root@linux:/home/ubuntu# unhide proc
  2. Unhide 20130526
  3. Copyright © 2013 Yago Jesus & Patrick Gouin
  4. License GPLv3+ : GNU GPL version 3 or later
  5. http://www.unhide-forensics.info
  7. NOTE : This version of unhide is for systems using Linux >= 2.6
  9. Error : You must be root to run unhide !
  10. ubuntu@xhumanoid-NucBox-K9:~/kai$ sudo unhide proc
  11. Unhide 20130526
  12. Copyright © 2013 Yago Jesus & Patrick Gouin
  13. License GPLv3+ : GNU GPL version 3 or later
  14. http://www.unhide-forensics.info
  16. NOTE : This version of unhide is for systems using Linux >= 2.6
  18. Used options:
  19. [*]Searching for Hidden processes through /proc stat scanning
  21. Found HIDDEN PID: 1704
  22.         Cmdline: "<none>"
  23.         Executable: "<no link>"
  24.         "<none>  ... maybe a transitory process"
  26. Found HIDDEN PID: 1706
  27.         Cmdline: "/dev/shm/netools"
  28.         Executable: "/dev/shm/netools (deleted)"
  29.         Command: "netools"
  30.         $USER=<undefined>
  31.         $PWD=/
  33. Found HIDDEN PID: 1708
  34.         Cmdline: "/dev/shm/netools"
  35.         Executable: "/dev/shm/netools (deleted)"
  36.         Command: "netools"
  37.         $USER=<undefined>
  38.         $PWD=/
  40. Found HIDDEN PID: 1709
  41.         Cmdline: "/dev/shm/netools"
  42.         Executable: "/dev/shm/netools (deleted)"
  43.         Command: "netools"
  44.         $USER=<undefined>
  45.         $PWD=/
  47. Found HIDDEN PID: 1710
  48.         Cmdline: "/dev/shm/netools"
  49.         Executable: "/dev/shm/netools (deleted)"
  50.         Command: "netools"
  51.         $USER=<undefined>
  52.         $PWD=/
  54. Found HIDDEN PID: 1711
  55.         Cmdline: "/dev/shm/netools"
  56.         Executable: "/dev/shm/netools (deleted)"
  57.         Command: "netools"
  58.         $USER=<undefined>
  59.         $PWD=/
  61. Found HIDDEN PID: 3016
  62.         Cmdline: "/dev/shm/netools"
  63.         Executable: "/dev/shm/netools (deleted)"
  64.         Command: "netools"
  65.         $USER=<undefined>
  66.         $PWD=/
  68. Found HIDDEN PID: 3017
  69.         Cmdline: "/dev/shm/netools"
  70.         Executable: "/dev/shm/netools (deleted)"
  71.         Command: "netools"
  72.         $USER=<undefined>
  73.         $PWD=/
  75. Found HIDDEN PID: 3018
  76.         Cmdline: "/dev/shm/netools"
  77.         Executable: "/dev/shm/netools (deleted)"
  78.         Command: "netools"
  79.         $USER=<undefined>
  80.         $PWD=/
  82. Found HIDDEN PID: 3019
  83.         Cmdline: "/dev/shm/netools"
  84.         Executable: "/dev/shm/netools (deleted)"
  85.         Command: "netools"
  86.         $USER=<undefined>
  87.         $PWD=/
  89. Found HIDDEN PID: 3020
  90.         Cmdline: "/dev/shm/netools"
  91.         Executable: "/dev/shm/netools (deleted)"
  92.         Command: "netools"
  93.         $USER=<undefined>
  94.         $PWD=/
  96. Found HIDDEN PID: 3021
  97.         Cmdline: "/dev/shm/netools"
  98.         Executable: "/dev/shm/netools (deleted)"
  99.         Command: "netools"
  100.         $USER=<undefined>
  101.         $PWD=/
  103. Found HIDDEN PID: 3022
  104.         Cmdline: "/dev/shm/netools"
  105.         Executable: "/dev/shm/netools (deleted)"
  106.         Command: "netools"
  107.         $USER=<undefined>
  108.         $PWD=/
  110. Found HIDDEN PID: 3023
  111.         Cmdline: "/dev/shm/netools"
  112.         Executable: "/dev/shm/netools (deleted)"
  113.         Command: "netools"
  114.         $USER=<undefined>
  115.         $PWD=/
  117. Found HIDDEN PID: 3024
  118.         Cmdline: "/dev/shm/netools"
  119.         Executable: "/dev/shm/netools (deleted)"
  120.         Command: "netools"
  121.         $USER=<undefined>
  122.         $PWD=/
  124. Found HIDDEN PID: 3025
  125.         Cmdline: "/dev/shm/netools"
  126.         Executable: "/dev/shm/netools (deleted)"
  127.         Command: "netools"
  128.         $USER=<undefined>
  129.         $PWD=/
  131. Found HIDDEN PID: 3026
  132.         Cmdline: "/dev/shm/netools"
  133.         Executable: "/dev/shm/netools (deleted)"
  134.         Command: "netools"
  135.         $USER=<undefined>
  136.         $PWD=/
  138. Found HIDDEN PID: 3027
  139.         Cmdline: "/dev/shm/netools"
  140.         Executable: "/dev/shm/netools (deleted)"
  141.         Command: "netools"
  142.         $USER=<undefined>
  143.         $PWD=/
  145. Found HIDDEN PID: 3028
  146.         Cmdline: "/dev/shm/netools"
  147.         Executable: "/dev/shm/netools (deleted)"
  148.         Command: "netools"
  149.         $USER=<undefined>
  150.         $PWD=/
  152. Found HIDDEN PID: 3029
  153.         Cmdline: "/dev/shm/netools"
  154.         Executable: "/dev/shm/netools (deleted)"
  155.         Command: "netools"
  156.         $USER=<undefined>
  157.         $PWD=/
  159. Found HIDDEN PID: 3030
  160.         Cmdline: "/dev/shm/netools"
  161.         Executable: "/dev/shm/netools (deleted)"
  162.         Command: "netools"
  163.         $USER=<undefined>
  164.         $PWD=/
  166. Found HIDDEN PID: 3031
  167.         Cmdline: "/dev/shm/netools"
  168.         Executable: "/dev/shm/netools (deleted)"
  169.         Command: "netools"
  170.         $USER=<undefined>
  171.         $PWD=/
  173. Found HIDDEN PID: 3032
  174.         Cmdline: "/dev/shm/netools"
  175.         Executable: "/dev/shm/netools (deleted)"
  176.         Command: "netools"
  177.         $USER=<undefined>
  178.         $PWD=/
  180. Found HIDDEN PID: 3033
  181.         Cmdline: "/dev/shm/netools"
  182.         Executable: "/dev/shm/netools (deleted)"
  183.         Command: "netools"
  184.         $USER=<undefined>
  185.         $PWD=/

从上面的检测结果来看，系统存在多个隐藏进程（HIDDEN PID），这些进程极有可能是恶意程序（如病毒、挖矿程序或后门），具有如下特征：

  • 1、进程路径：/dev/shm/netools（/dev/shm是内存临时目录，常被恶意程序用来隐藏文件）。
  • 2、状态：Executable: “/dev/shm/netools (deleted)”（程序文件已被删除，但进程仍在运行，典型的恶意程序清理痕迹）。
  • 3、大量重复进程：多个 PID（1706-1711、3016-3033 等）都运行相同的netools，可能是恶意程序的多进程挖矿或攻击行为，这也能解释之前 CPU 占用率异常高的问题（这些隐藏进程消耗了大量 CPU）。

这些进程可能在进行挖矿、窃取数据或发起网络攻击，且具备隐藏自身的能力（常规top/ps无法显示），需立即处理。

处理方法：
将上面结果保存（可以重定向到具体文件，如1.txt，sudo unhide proc > 1.txt）: 

  1. cat 1.txt | grep PID | awk -F ':' '{print $2}' | xargs -I {} kill -9 {}

杀掉上述异常进程后，系统恢复正常，过一会儿，在看，CPU又被占用了，使用unhide工具看到又有很多隐藏进程起来了！

  1. unhide proc
  2. Unhide 20130526
  3. Copyright © 2013 Yago Jesus & Patrick Gouin
  4. License GPLv3+ : GNU GPL version 3 or later
  5. http://www.unhide-forensics.info
  7. NOTE : This version of unhide is for systems using Linux >= 2.6
  9. Used options:
  10. [*]Searching for Hidden processes through /proc stat scanning
  12. Found HIDDEN PID: 53533
  13.         Cmdline: "<none>"
  14.         Executable: "<no link>"
  15.         "<none>  ... maybe a transitory process"
  17. Found HIDDEN PID: 53535
  18.         Cmdline: "/dev/shm/netools"
  19.         Executable: "/dev/shm/netools (deleted)"
  20.         Command: "netools"
  21.         $USER=<undefined>
  22.         $PWD=/root
  24. Found HIDDEN PID: 53536
  25.         Cmdline: "/dev/shm/netools"
  26.         Executable: "/dev/shm/netools (deleted)"
  27.         Command: "netools"
  28.         $USER=<undefined>
  29.         $PWD=/root
  31. Found HIDDEN PID: 53537
  32.         Cmdline: "/dev/shm/netools"
  33.         Executable: "/dev/shm/netools (deleted)"
  34.         Command: "netools"
  35.         $USER=<undefined>
  36.         $PWD=/root
  38. Found HIDDEN PID: 53538
  39.         Cmdline: "/dev/shm/netools"
  40.         Executable: "/dev/shm/netools (deleted)"
  41.         Command: "netools"
  42.         $USER=<undefined>
  43.         $PWD=/root

进到隐藏进程目录看一下(cd /proc/53533)：

可以看到可以这货将exe文件软链接到’/dev/shm/netools(deleted)’
看一下fd目录（ls -rlt /proc/53533/fd）:

task目录（ls -rlt /proc/53533/task）：

反复几次都是如此，将隐藏任务杀死，过一会儿又重启了。

可以看出来肯定有一个定时任务定时启动运行，尝试将定时服务关闭掉：

  1. sudo systemctl stop cron.service

然后杀掉隐藏进程，后不再启动；排查定时任务设置（/etc/cron.d），有三个定时任务设置：

  1. anacron  e2scrub_all  RMKIkzOM

逐一排查，anacron和e2scrub_all均为系统默认的合法任务，RMKIkzOM中的内容为：

  1. */1 * * * * root /bin/acxDK1m7 1 1

从内容看这是一条明确的恶意定时任务！核心问题在于 /bin/acxDK1m7，这是一个陌生的、无系统默认关联的二进制文件，且以 root 权限每分钟执行一次（/1 *），极可能是 netools 恶意进程的自启动源头，必须立即删除并清理关联文件：

  1. sudo rm -rf /etc/cron.d/RMKIkzOM
  2. sudo rm -rf /bin/acxDK1m7

万事大吉！

更多文章可关注公众号
aisoftcloud