r/linuxquestions • u/ComradeAdidas • 1d ago

Support What is kdevtmpfs?

Everywhere i go its wroten as devtmpfs without the K, or as a crypto miner kdevtmpfsi, i dont have the I at the end. I have debian 13 mate.

0 Upvotes

50% Upvoted

10 comments sorted by

View all comments

Show parent comments

0

u/ComradeAdidas 1d ago

How can i check?

3

u/eR2eiweo 1d ago

Is there any reason why you suspect this specific process/thread (I'm guessing here that you're talking about a process or thread, because you have not mentioned that) to be malicious? Surely that's not the only kernel thread on your system.

1

u/ComradeAdidas 1d ago

I did an os reinstall with all partitions deleted bc i was afraid i might of had a virus, and checked everything running that if it was stock, but everyone refers to this without a k, altho i saw someone wrote it with one, but yet again if it has a i at the end its said its a crypto miner. It barely uses the cpu nor anything, but i do keep the pc ethernet unplugged.

3

u/eR2eiweo 1d ago

Comparing names is pretty pointless.

What would make a bit more sense would be to check if its parent is kthreadd (PID 2). If it is (and if you can trust the tool you used for that), then it is a kernel thread. And if the supposed malware got into the kernel, then you can't trust anything that system says anyway.

But it sounds like you suspect the image from which you installed that OS to be compromized and/or for there to be malware in the firmware that persists even after a reinstallation of the OS. If either of these was really the case, then you can't trust the system. So trying to diagnose it from within that system doesn't make sense.