It is a miner that you probably installed yourself or installed as part of some piece of software. If not crontabs are stored in /var/spool/cron/crontabs/. Otherwise you only need the LAST line of these 2. That will kill access to that fileįrom a user prompt if possible if that is not YOUR user: sudo -u fabio Look at the image above, the "user" that is running this virus is a user "999" I have no idea how this is possible because this user does not exist.įirst. There is a suspect job in crontab using wget to download a sh script, I cannot find how to delete this, and I am not sure if this will come back again when I turn on docker container with redis. īut it is still coming again and again when docker container with redis is running.īut there is stil one thing that I could not do, when I run the command for user in $(cut -f1 -d: /etc/passwd) do echo $user crontab -u $user -l done to see all users crontab, this is my output: no crontab for gdm My Ubuntu server has been infected by a virus kdevtmpfsi, I have already done serveral steps to solve this problem, like all of these.
0 kommentar(er)
