0

I am working on Ubuntu remote server. I deleted automatic cron jobs from my server, but it recovered automatically after some days and occupy my 50% CPU. I attached cron job file from my server here (this is created by some one). Please guide me in this regards.

###########
0 0 */3 * * /tmp/.X19-unix/.rsync/a/upd>/dev/null 2>&1
5 8 * * 0 /tmp/.X19-unix/.rsync/b/sync>/dev/null 2>&1
@reboot /tmp/.X19-unix/.rsync/b/sync>/dev/null 2>&1
0 0 */3 * * /tmp/.X19-unix/.rsync/c/aptitude>/dev/null 2>&1
#############################################################
Improve this question
2
  • 3
    I googled "rsync aptitude" to see if rsync self-installed a server start, and my top hit was a Ubuntu forum thread on crypto-mining malware in Ubuntu. Commented Jan 27, 2020 at 10:19
  • Yep, this looks like the same hack as in Unauthorized access to cron. Commented Jan 27, 2020 at 10:33

1 Answer 1

Reset to default
0

The security paper on Medium We finally learn what hacker Rosey wants explain how the crypto-miner malware work, the root cause is a weak root password. see How do I deal with a compromised server? on ServerFault.

Related:

AskUbuntu: crond64/tsm virus in Ubuntu

U&L: Suspicious crontab entry running 'xribfa4' every 15 minutes

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.