[Discuss] infected by cupsddh skysapd, skysapdd

[K Wong]

Reinstall your OS and rebuild your box. I wouldn't trust a box that had
been hacked and then "cleaned".

K


On Fri, Mar 14, 2014 at 4:31 AM, J B <bakshi12 at gmail.com> wrote:

> Hello list,
>
> my debian box is infected by  upsddh skysapd, sksapd maleware.
>
> I have already remove the huge unknown cron from root.
>
> Deleted
>
>  /etc/ksapd
>  /etc/kysapd
>  /etc/atdd
>
> but problem with cupsdd
>
> ls -l cupsdd
> -rwsrwsrwt 1 root root 1245451 Feb 27 16:43 cupsdd
>
>
> #rm cupsdd
> rm: cannot remove ‘cupsdd’: Operation not permitted
>
> and this cupsdd agin recreates all other above deleted files to eat the
> resources .
>
> Any fix available ?
>
> Thanks
> _______________________________________________
> Discuss mailing list
> Discuss at vlug.org
> http://lists.vlug.org/mailman/listinfo/discuss
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://vlug.org/pipermail/discuss_vlug.org/attachments/20140314/ce2fd7f9/attachment.html>