Unwanted process automatically starting up

[dickiebird]

Guys
A weird one, this !
I log in to our test server (RS6000 AIX 4.3.3) and an executable program immediately starts up. I stop it and then kill it - end of problem.
But why should it start all by itself ?
There's no reference to the exe in my ~/.profile nor /.profile
nor /etc/rc nor /etc/environment.
Any other places I should look ?
TIA
;-) Dickie Bird
db@dickiebird.freeserve.co.uk

 

[DSMARWAY]

do you have an entry in your /etc/passwd file

where it normally has the shell is it running the exe

HTH

 

[vgersh99]

check your /etc/services & /etc/inetd.conf [on Solaris - might be diff. on AIX]. CHeck if you have a port setup connecting [sending a packet to which] would start a process. vlad
+---------------------------+
|#include<disclaimer.h> |
+---------------------------+

 

[dickiebird]

Hi Guys
Thanks for your thoughts so far - but no joy, unfortunately.
There's no reference to 'sda' ( the unwanted exe that starts up) or to my login 'dbird' in any of the /etc files
The method I use to connect to the server is CRT from VanDyke Technologies (creates a telnet session onto the AIX Server)
The program that runs is an in-house program to update some flat(index and text) files (which on this box, is a legacy process that wouldn't ordinarily be run anyway).
Any other thoughts ???
;-) Dickie Bird
db@dickiebird.freeserve.co.uk

 

[DSMARWAY]

hi,

do you know the name of the executable ?

if so grep for it in etc , / , directory to see where it is being called form .

If possible , rename the exe and then login , it should complain about not being found and from where.

 

[jamisar]

if you find nothing in all concerned dotfiles and /etc (see vlad's answer) are the 'login' && 'passwd' binaries ORIGINAL ?? vox clamantis in deserto.

 

[jamisar]

my be a cronjob listening for new logins ? vox clamantis in deserto.

 

[dickiebird]

Guys -

Here's the latest, after having checked all of /etc for the exe named 'sda'
and finding no reference to it.
NB This test server was set up from a mksysb from another server ( by our Unix admin guys - who I have already quizzed with regard to the problem)

ps -ef gives :
root 10618 4902 0 09:27:02 - 0:00 telnetd -a
dbird 13984 16588 10 09:27:15 pts/1 0:01 sda var=27968
dbird 16588 10618 1 09:27:09 pts/1 0:00 -ksh

Removing sda from the runtime directory gives (at login):

Please Enter User Name: dbird
dbird's Password:
*******************************************************************************
* *
* Welcome to AIX Version 4.3.3 *
* Please see the README file in /usr/lpp/bos for information pertinent to *
* this release of the AIX Operating System. *
* *
*******************************************************************************
Last unsuccessful login: Tue 15 Oct 08:27:05 2002 on /dev/pts/1 from 145.224.222.72
Last login: Thu 17 Oct 09:27:14 2002 on /dev/pts/1 from 145.224.222.72

sda

dbird on pongo: /u/dbird > sda
ksh: sda: not found.
dbird on pongo: /u/dbird >

Does this help ?
TIA
;-) Dickie Bird
db@dickiebird.freeserve.co.uk

 

[jamisar]

this appens for all logins ?
only for dbird ? vox clamantis in deserto.

 

[dickiebird]

I have wasted a lot of people's time here !
I humbly apologise for that.
My telnet session was spawning the process because I'd got automated login set to yes and sda as user !
Very embarrassed or what? :~/ Dickie Bird
db@dickiebird.freeserve.co.uk