What are ublockd and tblockd?

[hongqn]

One of my servers behaves strangely these days. Every day after around 9am, it refuses ssh connections from outside, while the already connected ssh logins still work. It comes back to work after a cold reset (because it is in a remote IDC). And some files were lost, including /bin/passwd, /usr/bin/passwd, /var/log/*, and maybe some others we haven't found out.

`top` shows there are two processes, ublockd and tblockd, are using ~5% CPU each. What are they? I googled but found nothing. Maybe these two processes are relative to the strange behaviors? Or some bad guy has stolen my password?
_________________
God's in his heaven, all's right with the world.
Registered Linux User #396996

[jcat]

Never heard of them. I'm not saying you have definitely been hacked, but something doesn't smell right...

Change your passwords
Check your system logs and run some of the root kit detection utilities.

Even if you haven't been compromised it's a good thing to do occasionally.



Cheers,
jcat

[di1bert]

I'd start with installing chkrootkit and rkhunter to see what they have to say. It certainly doesn't sound like a
good place to be in.

-m