[Discuss] infected by cupsddh skysapd, skysapdd

[Cy Schubert]

Agreed.

You will need to restore your data from backups prior to the compromise. 
Recreate whatever data you may have too or restore your personal files from 
backups from prior to the compromise.


-- 
Cheers,
Cy Schubert <Cy.Schubert at komquats.com>
FreeBSD UNIX:  <cy at FreeBSD.org>   Web:  http://www.FreeBSD.org


In message <CAJYmURH5YoLgOY4d64ZDn7vnuam=0bmXT5TqqyDMOUYRkzptFg at mail.gmail.c
om>
, K Wong writes:
> --===============0781666774594964863==
> Content-Type: multipart/alternative; boundary=089e0158c1580ad6df04f48fefe6
> 
> --089e0158c1580ad6df04f48fefe6
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: quoted-printable
> 
> Reinstall your OS and rebuild your box. I wouldn't trust a box that had
> been hacked and then "cleaned".
> 
> K
> 
> 
> On Fri, Mar 14, 2014 at 4:31 AM, J B <bakshi12 at gmail.com> wrote:
> 
> > Hello list,
> >
> > my debian box is infected by  upsddh skysapd, sksapd maleware.
> >
> > I have already remove the huge unknown cron from root.
> >
> > Deleted
> >
> >  /etc/ksapd
> >  /etc/kysapd
> >  /etc/atdd
> >
> > but problem with cupsdd
> >
> > ls -l cupsdd
> > -rwsrwsrwt 1 root root 1245451 Feb 27 16:43 cupsdd
> >
> >
> > #rm cupsdd
> > rm: cannot remove =E2=80=98cupsdd=E2=80=99: Operation not permitted
> >
> > and this cupsdd agin recreates all other above deleted files to eat the
> > resources .
> >
> > Any fix available ?
> >
> > Thanks
> > _______________________________________________
> > Discuss mailing list
> > Discuss at vlug.org
> > http://lists.vlug.org/mailman/listinfo/discuss
> >
> 
> --089e0158c1580ad6df04f48fefe6
> Content-Type: text/html; charset=UTF-8
> Content-Transfer-Encoding: quoted-printable
> 
> <div dir=3D"ltr">Reinstall your OS and rebuild your box. I wouldn&#39;t tru=
> st a box that had been hacked and then &quot;cleaned&quot;.<div><br></div><=
> div style>K</div></div><div class=3D"gmail_extra"><br><br><div class=3D"gma=
> il_quote">
> On Fri, Mar 14, 2014 at 4:31 AM, J B <span dir=3D"ltr">&lt;<a href=3D"mailt=
> o:bakshi12 at gmail.com" target=3D"_blank">bakshi12 at gmail.com</a>&gt;</span> w=
> rote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde=
> r-left:1px #ccc solid;padding-left:1ex">
> Hello list,<br>
> <br>
> my debian box is infected by =C2=A0upsddh skysapd, sksapd maleware.<br>
> <br>
> I have already remove the huge unknown cron from root.<br>
> <br>
> Deleted<br>
> <br>
> =C2=A0/etc/ksapd<br>
> =C2=A0/etc/kysapd<br>
> =C2=A0/etc/atdd<br>
> <br>
> but problem with cupsdd<br>
> <br>
> ls -l cupsdd<br>
> -rwsrwsrwt 1 root root 1245451 Feb 27 16:43 cupsdd<br>
> <br>
> <br>
> #rm cupsdd<br>
> rm: cannot remove =E2=80=98cupsdd=E2=80=99: Operation not permitted<br>
> <br>
> and this cupsdd agin recreates all other above deleted files to eat the res=
> ources .<br>
> <br>
> Any fix available ?<br>
> <br>
> Thanks<br>
> _______________________________________________<br>
> Discuss mailing list<br>
> <a href=3D"mailto:Discuss at vlug.org">Discuss at vlug.org</a><br>
> <a href=3D"http://lists.vlug.org/mailman/listinfo/discuss" target=3D"_blank=
> ">http://lists.vlug.org/mailman/listinfo/discuss</a><br>
> </blockquote></div><br></div>
> 
> --089e0158c1580ad6df04f48fefe6--
> 
> --===============0781666774594964863==
> Content-Type: text/plain; charset="us-ascii"
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> 
> _______________________________________________
> Discuss mailing list
> Discuss at vlug.org
> http://lists.vlug.org/mailman/listinfo/discuss
> 
> --===============0781666774594964863==--
> 
>