title: kdevtmpfsi - how to find and delete that miner
body: <p><a href="https://i.stack.imgur.com/vegaV.png" rel="noreferrer"><img src="https://i.stack.imgur.com/vegaV.png" alt="enter image description here"></a></p>
  
  <p>I saw in my Linux (Ubuntu) server processes, called: <code>kdevtmpfsi</code>. It utilized 100% of all CPUs and RAM...</p>
  
  <p>1) Tried to find a word in linux files:</p>
  
  <pre><code>find / -type f -exec grep -l "kdevtmpfsi" {} +
  </code></pre>
  
  <p>2) And found a file in the docker _data folder:</p>
  
  <pre><code>/var/lib/docker/volumes/d2076917e9f44b55d1fbfe2af6aca706f3cc52ca615e5f5de1ae1fdb4a040154/_data/kinsingj2BpMsGgCo
  </code></pre>
  
  <p>3) It is called like sha-ashed file: kinsingj2BpMsGgCo. So I removed it:</p>
  
  <pre><code>rm /var/lib/docker/volumes/d2076917e9f44b55d1fbfe2af6aca706f3cc52ca615e5f5de1ae1fdb4a040154/_data/kinsingj2BpMsGgCo
  </code></pre>
  
  <p>4) And restarted my server:</p>
  
  <pre><code>restart
  </code></pre>
  
  <p>But it doesn`t works. It copy new file in docker _data container and runs when docker starts... </p>
  
  <p><a href="https://i.stack.imgur.com/hQkTd.png" rel="noreferrer"><img src="https://i.stack.imgur.com/hQkTd.png" alt=""></a></p>
  
  <p>Does anybody know what to do with it?</p>
  
  <hr>
  
  <p><strong><em>UPDATE:</em></strong></p>
  
  <p>We have killed that miner with dext steps:</p>
  
  <ol>
  <li>First of all - close redis ports on your server or add a password.</li>
  <li>Remove from crontab command with .sh instructions </li>
  <li>Delete hashed file from <code>docker/{{volume}}/_data</code> folder </li>
  <li>Delete <code>tmp/kdevtmpfsi</code> file </li>
  </ol>