Determining process locations on a compromised server

I'm not sure what the problem could be but it's likely bad. My guess is that your machine has been compromised, and the processes are running a "brute force" password guessing program or attacks against other machines.

The safest solution is to save your applications and data, and start with a freshly installed Linux distribution on a new machine.

In the meantime, you can get an idea of what is running and where the program is located by looking at the /proc entry for one of the processes. Use the 'top' or 'ps' programs to find the process ID (PID)of a 'brute'. Then, look in /proc//maps to find where the executable is located.

root# ps ax | grep brute | head -10
26235 ?        Ss     0:00 /tmp/.../.brute
  ...
root# cat /proc/26235/maps
00b31000-00b4a000 r-xp 00000000 03:0a 612182     /lib/ld-2.4.so
00b4a000-00b4b000 r-xp 00018000 03:0a 612182     /lib/ld-2.4.so
00b4b000-00b4c000 rwxp 00019000 03:0a 612182     /lib/ld-2.4.so
00b4e000-00c7b000 r-xp 00000000 03:0a 612183     /lib/libc-2.4.so
...
08047000-08052000 r-xp 00000000 03:0a 614274     /tmp/.../.brute
08052000-08053000 rw-p 0000b000 03:0a 614274     /tmp/.../.brute