"find" Proces Being Run By "nobody"

Every once in a while my hard disk light is flashing continuously for a few minutes, even if I am just reading a fully loaded webpage. doing a "top" command shows that "find" is running and the user is "nobody" - is this a virus or something or something normal?? Seems to have started when I upraded to KDE 3.2.3 and now also with 3.3.

Well, I don't see anything like that in my suse 9.1 installation, and I run kde 3.3. But that does not necessarily mean there's something weird happening in your machine. Are you running any servers on your machine? And how often do you see this happening? Few times in a day, or every now and then? If it runs regularly at fixed intervals, it could be a cronjob. Just a thought ...

No servers or anything, stand along machine on a router. I'd say it happens most often within minutes after login.

some things are cron jobs. one of which is logrotate.

find is not usually a cron job. why would it be? find is to find a file or folder. why make a cron job out of that?

my suspicion is that someone has hacked into your system. obviously, there not very good or you wouldnt have noticed them.

edit your /etc/securetty and comment out everything (except maybe tty7. thats the one the system uses for X windows).

change your passwords.

tell X windows to tcp-nolisten. /etc/X11/xdm/Xservers

http://mandrakeusers.org/index.php?showtopic=13265 (a security overview i wrote).

uninstall any server (and there are quite a few).

Find could be a cron job, if you have an "updatedb" job for "locate". See the crond config, or stop crond for a while to see if it still happens.

I can confirm that some cron jobs indeed use find. For example, see /etc/cron.daily/suse.de-clean-tmp and /etc/cron.daily/suse.de-clean-vi.

But the questions remain -- even if it is those jobs that are running, do they run as user 'nobody'? And even then, they are supposed to run only at some time early in the morning. Why do they run often?

Now, that said, I know my laptop indeed appears to run a few processes immediately after startup. I haven't checked to see what they are. But 1) they run for the first few seconds, 2) don't slow it down by much, and 3) never run again, at least not so visibly.

So, I'll say if these things run only once immediately after login, they are probably not harmful. If they run every now and then, something's very likely amiss
:unsure: Unless you are running some server that does this without knowing it.

Why on my machine?
In kde there are 3 users
In gnome, blackbox and the rest there are only 2 users

I have only root and me listed in this machine
Please advice

Thanks,
con