Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

8
  • 4
    If it isn't your miner process running as www-data (httpd) from /tmp, then your server is quite possibly hacked. Commented Apr 24, 2018 at 22:02
  • I read in other articles about the Jenkins servers (which mine is) issue that turn them into XMRIG mining slaves - which can be seen in "/tmp/.FILE/stak/xmrig -o". Does anyone know how to stop & remove this from the server? Commented Apr 24, 2018 at 22:06
  • Put the server into single user runlevel. Block the IP in your log on the FW. Kill processes. Remove their files. Patch the vulnerability and return to normal op. This way you may be able to avoid rebuilding. Commented Apr 24, 2018 at 22:27
  • 1
    Your server is hacked and being used for crypto-currency mining. Commented Apr 24, 2018 at 22:48
  • 3
    The intruder has probably done something to make the system give you false information about either the system's firewall configuration, or about the source IP of the intruder. This is why dsstorefile said you'll have to restore from backup: you don't know for sure the full scope of the intruders' actions without a very labor-intensive investigation. Restoring from backup and/or rebuilding is usually easier, and gives you a strong guarantee that no intruder's tools are left hidden in the system. Commented Apr 25, 2018 at 5:55