*buntu 8.04: dd running at startup?

[TheDoktor]

Hello folks, I have recently discovered, while running XFCE Process Manager, that the famous-infamous "dd" program is running (at every boot, yeah) ; I can't imagine which program is launching it and for which reason, however, I'm stopping it with "sudo kill xxxx" each time I reboot my PC (xxxx is the relevant process id-number, as seen in process manager).
So what is that, malware activity? Someone/something trying to wipe my hard drive?


About my PC: I am using these days a somewhat-very-personal-flavor of XFCE running on top of Kubuntu 8.04 Hardy Heron, with a simple look and extremely personalized panels; this machine is based on an old Sempron 3000+, but I can ensure you that it runs fast, I use it for basic desktop activity and multimedia (including music editing with audacity).

[The Cog]

The command

pstree -lU

might help. dd's command line arguments will give you an idea what it's doing and the tree will show you what launched it.

[mörgæs]

Thought 8.04 might be fast it's not secure. As it has been out of support for many years it's likely that black hats have found security holes which will not be fixed.

Have you thought of a fresh install of 13.10?

[TheDoktor]

Thought 8.04 might be fast it's not secure. As it has been out of support for many years it's likely that black hats have found security holes which will not be fixed.

Have you thought of a fresh install of 13.10?

true, but the server edition was supported up to last April (if I am not wrong), and many files at http://old-releases.ubuntu.com/ubuntu/ hardy-updates look recent to me.
I am a freelance tech support and I need to experiment with everything I can, both software (OSes) and hardware equipment, I think I wll keep using this system for some tasks in my laboratory, and keep it away from the net.
I don't appreciate Unity, Gnome3 and KDE4, these desktop environments and those from MS (WIndoz V*sta onward), give me strong headaches due to their colours (well, it's even worst than this, but I am keeping private my own health issues);
I still like the Ubuntu family, I've tried Xubuntu and Lubuntu 13.04, both are very fine, though I like to grab the original XFCE and LXDE files and make my own desktop I didn't try anything 13.10, yet. I'll let you know.

[TheDoktor]

The command

pstree -lU

might help. dd's command line arguments will give you an idea what it's doing and the tree will show you what launched it.

Thank you , I tried it yesterday, but I got no clue yet, I will try it again later today, after next reboot.

[TheDoktor]

The command

pstree -lU

might help. dd's command line arguments will give you an idea what it's doing and the tree will show you what launched it.

After typing pstree -lU in terminal, this is what I got:

user@computer:~$ pstree -lU
init─┬─NetworkManager
     ├─NetworkManagerD
     ├─Thunar
     ├─acpid
     ├─anacron
     ├─atd
     ├─avahi-daemon───avahi-daemon
     ├─bonobo-activati───{bonobo-activati}
     ├─console-kit-dae───61*[{console-kit-dae}]
     ├─cron
     ├─cupsd
     ├─2*[dbus-daemon]
     ├─dbus-launch
     ├─dcopserver
     ├─dd
     ├─debtorrent-clie
     ├─dhcdbd
     ├─dirmngr
     ├─gam_server
     ├─gconfd-2
     ├─6*[getty]
     ├─gnome-keyring-d
     ├─gnome-power-man
     ├─gnome-screensav
     ├─gnome-terminal─┬─bash───pstree
     │                ├─gnome-pty-helpe
     │                └─{gnome-terminal}
     ├─gnome-volume-ma
     ├─hald───hald-runner─┬─hald-addon-acpi
     │                    └─hald-addon-inpu
     ├─hcid───2*[bluetoothd-serv]
     ├─jockey-gtk
     ├─kded
     ├─kdeinit───klauncher
     ├─kdm─┬─Xorg
     │     └─kdm───sh─┬─seahorse-agent
     │                ├─ssh-agent
     │                └─xfce4-session───{xfce4-session}
     ├─klogd
     ├─netdaemon
     ├─nm-applet
     ├─ntpd
     ├─syslogd
     ├─system-tools-ba
     ├─udevd
     ├─update-notifier
     ├─winbindd───winbindd
     ├─xfce-mcs-manage
     ├─xfce4-panel─┬─thunar-tpa
     │             ├─xfce4-clipman-p
     │             ├─xfce4-cpufreq-p
     │             ├─xfce4-cpugraph-
     │             ├─xfce4-menu-plug
     │             ├─2*[xfce4-mixer-plu]
     │             ├─xfce4-mount-plu
     │             ├─xfce4-netload-p
     │             └─xfce4-places-pl
     ├─xfce4-taskmanag
     ├─xfdesktop
     └─xfwm4

I've decided to rename dd into dd_ , this is turning effective, but it's just a temporary solution in my opinion.

[The Cog]

Well that listing wasn't useful. I had it in mind that '-l' would list the command line arguments to dd. Silly me.
Please can you do

ps -ef | grep dd

next time you boot, so we can see what dd is actually doing. I really doubt that it's a virus though.

[TheDoktor]

Well that listing wasn't useful. I had it in mind that '-l' would list the command line arguments to dd. Silly me.
Please can you do

ps -ef | grep dd

next time you boot, so we can see what dd is actually doing. I really doubt that it's a virus though.

that's the output:

user@computer:~$ sudo ps -ef | grep dd
[sudo] password for user:
root         2     0  0 19:06 ?        00:00:00 [kthreadd]
root      5262     1  0 19:09 ?        00:00:00 /bin/dd bs 1 if /proc/kmsg of /v                                                             ar/run/klogd/kmsg
root      5535     1  0 19:09 ?        00:00:00 /usr/sbin/winbindd
root      5586  5535  0 19:09 ?        00:00:00 /usr/sbin/winbindd
root      5709  5685  0 19:09 ?        00:00:00 /usr/lib/hal/hald-addon-cpufreq
109       5710  5685  0 19:09 ?        00:00:00 hald-addon-acpi: listening on ac                                                             pid socket /var/run/acpid.socket
root      5713  5685  0 19:09 ?        00:00:00 hald-addon-input: Listening on /                                                             dev/input/event1 /dev/input/event4 /dev/input/event5
root      5729  5685  0 19:10 ?        00:00:00 hald-addon-storage: polling /dev                                                             /scd0 (every 2 sec)
user      6370  6369  0 19:11 ?        00:00:00 /bin/sh -c ksysguardd
user      6371  6370  1 19:11 ?        00:00:06 ksysguardd
user      6814  6797  0 19:21 pts/3    00:00:00 grep dd

[TheDoktor]

thanks to the info provided by the grep command, I could do a more effective search, and I've found this page that seems to answer to my question:
http://fixunix.com/ubuntu/551193-why...ng-daemon.html

[mörgæs]

Good. If this solves your problem please mark the thread so.