kthreaddk is started by cron job. After it runs, it usually places its code in different directories and keeps updating crontab all the time.

To get rid of it follow these steps:

1. Identify which user crontab is running it.

$ cd /var/spool/cron/crontabs
# Preview each file here, e.g.
$ cat www-data
* * * * * /run/c8aaf4bea

The /run/c8aaf4bea looks weird, but do not remove it yet...

2. Block specific user from updating crontab (e.g. www-data). Edit cron.deny file

$ sudo vim /etc/cron.deny

and add a user name

www-data

Now the threaddk process is not able to edit crontab anymore.

3. Kill all the threaddk processes

$ sudo pkill -9 threaddk

4. Remove suspected line from the crontab

$ sudo vim /var/spool/cron/crontabs/www-data
* * * * * /run/c8aaf4bea     <- remove this line

5. Remove the user from cron.deny file

It's miner. It use crontab for restart(start) itself.

crontab -u postgres -l

I have similar problem. Just remove job from crontab and restart server imidiatly

I had miner on my vps. My CPU usage was always 100%. First moment i was thinking i have memory leak in my java app or tomcat. I could kill process but it was starting another one in few seconds. In my case it was on user account which i didn't use. I killed all user processes with pkill -u username and then fast deleted user by sudo deluser --remove-home username before miner started its' processes. After this vps worked fine. Maybe it will help someone.