Thursday, May 16, 2024
 Popular · Latest · Hot · Upcoming
47
rated 0 times [  47] [ 0]  / answers: 1 / hits: 15879  / 2 Years ago, sat, march 26, 2022, 4:01:45

I keep getting weir cron jobs showing up and I have no clue what they do. I typically issue kill -9 to stop them. They take up 100% of my CPU and can run for days until I check. Does anyone know what this means?



sudo crontab -l
0 0 */3 * * /root/.firefoxcatche/a/upd>/dev/null 2>&1
@reboot /root/.firefoxcatche/a/upd>/dev/null 2>&1
5 8 * * 0 /root/.firefoxcatche/b/sync>/dev/null 2>&1
@reboot /root/.firefoxcatche/b/sync>/dev/null 2>&1
#5 1 * * * /tmp/.X13-unix/.rsync/c/aptitude>/dev/null 2>&1


I am running Ubuntu 18 LTS server fully up-to-date as of yesterday 7/24/2019



UPDATE



I appreciate all the feedback. I have disconnected all data and application drives since the only thing that was affected was the OS drive, I at least did that sort of thing properly. I am going with a complete rebuild, with a lot more security and more secure methods.


More From » server

 Answers
0

Your machine most likely has a crypto miner infection. You can see someone else reporting similar filenames and behaviour at Real-life detection of a virtual machine in Azure with Security Center. See also My Ubuntu Server has a virus... I've located it but I can't get rid of it... on Reddit.



You can no longer trust that machine, and should re-install it. Be careful with restoring backups.


[#5172] Sunday, March 27, 2022, 2 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
irripri

Total Points: 164
Total Questions: 111
Total Answers: 107

Location: South Georgia
Member since Sun, Aug 8, 2021
3 Years ago
irripri questions
Mon, Aug 29, 22, 03:19, 2 Years ago
Thu, Mar 30, 23, 01:56, 1 Year ago
Thu, Dec 30, 21, 08:53, 2 Years ago
;