CPU 100% - Is it a virus?

[Soberg]

Hi i have 100% CPU all time.

what can i do?

 

[Squid]

Post your diagnostics.  The "hezb" process is meaningless without more context while it's in this state

[ashman70]

What are you running on your server?
I would block that IP address in your firewall 142.93.8.2

[Soberg]

thx. i post it here.

tower-diagnostics-20220129-2021.zip

[Bgordy2013]

Did you figure this out? Also seeing high RAM and CPU usage from that same process? Can't find anything but this post about it online. It seemed to crop up may 5-6 days ago. Thanks!

Edited February 3, 2022 by Bgordy2013

[Squid]

On 1/29/2022 at 2:23 PM, Soberg said:

thx. i post it here.

tower-diagnostics-20220129-2021.zip 100.53 kB · 2 downloads

Sorry I missed your reply

 

The hezb process is coming from your unifi docker app

root     11227  0.0  0.0 112036  6364 ?        Sl   20:00   0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 759460c22cf3d809b0564a2a0c1cc5490b1d149cbe2763eb4d3ccf90750d7a22 -address /var/run/docker/containerd/containerd.sock
root     11252  0.0  0.0    204     4 ?        Ss   20:00   0:00  \_ s6-svscan -t0 /var/run/s6/services
nobody   25600  197 14.7 2821392 2404568 ?     Ssl  20:09  24:56      \_ hezb -o 142.93.8.2:80 -u 759460c22cf3 -k -B
nobody   22263  9.6  0.0   4632  1748 ?        S    20:08   1:13      \_ /bin/sh ./6beb05a
root     11352  0.0  0.0    204     4 ?        S    20:00   0:00      \_ s6-supervise s6-fdholderd
root     11686  0.0  0.0    204     4 ?        S    20:00   0:00      \_ s6-supervise unifi
nobody   11689  4.4  4.2 4698128 685620 ?      Ssl  20:00   0:55          \_ java -Xmx1024M -jar /usr/lib/unifi/lib/ace.jar start
nobody   12542  0.5  0.6 959408 108160 ?       Sl   20:00   0:06              \_ bin/mongod --dbpath /usr/lib/unifi/data/db --port 27117 --unixSocketPrefix /usr/lib/unifi/run --logRotate reopen --logappend --logpath /usr/lib/unifi/logs/mongod.log --pidfilepath /usr/lib/unifi/run/mongod.pid --bind_ip 127.0.0.1

 

I would suggest you hit up linuxserver and @Roxedus on LSIO's discord (hit the icon and then hit support or discord) and they can properly help you diagnose if this should be here (the IP address implies that it shouldn't)  Old versions of the unifi app were susceptible to Log4J, but whether that's the case here they would know 

[Bgordy2013]

Squid thanks for the help, I was running a few versions behind on my Unifi Controller docker. An update to the latest version seems to have resolved the issue, no longer seeing the high resource utilization!