[Discuss] infected by cupsddh skysapd, skysapdd

[John Blomfield]

See:

https://isc.sans.edu/forums/diary/Unfriendly+crontab+additions/17282/

John


On 03/14/2014 04:31 AM, J B wrote:
> Hello list,
>
> my debian box is infected by  upsddh skysapd, sksapd maleware.
>
> I have already remove the huge unknown cron from root.
>
> Deleted
>
>   /etc/ksapd
>   /etc/kysapd
>   /etc/atdd
>
> but problem with cupsdd
>
> ls -l cupsdd
> -rwsrwsrwt 1 root root 1245451 Feb 27 16:43 cupsdd
>
>
> #rm cupsdd
> rm: cannot remove ‘cupsdd’: Operation not permitted
>
> and this cupsdd agin recreates all other above deleted files to eat the resources .
>
> Any fix available ?
>
> Thanks
> _______________________________________________
> Discuss mailing list
> Discuss at vlug.org
> http://lists.vlug.org/mailman/listinfo/discuss


-- 
John Blomfield
Delivered by Thunderbird Email on Linux OpenSuse-KDE4

Old John B's Linux Notes http://www.oldjohnbslinux.wordpress.com