<div dir="ltr">Reinstall your OS and rebuild your box. I wouldn't trust a box that had been hacked and then "cleaned".<div><br></div><div style>K</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Fri, Mar 14, 2014 at 4:31 AM, J B <span dir="ltr"><<a href="mailto:bakshi12@gmail.com" target="_blank">bakshi12@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello list,<br>
<br>
my debian box is infected by upsddh skysapd, sksapd maleware.<br>
<br>
I have already remove the huge unknown cron from root.<br>
<br>
Deleted<br>
<br>
/etc/ksapd<br>
/etc/kysapd<br>
/etc/atdd<br>
<br>
but problem with cupsdd<br>
<br>
ls -l cupsdd<br>
-rwsrwsrwt 1 root root 1245451 Feb 27 16:43 cupsdd<br>
<br>
<br>
#rm cupsdd<br>
rm: cannot remove \u2018cupsdd\u2019: Operation not permitted<br>
<br>
and this cupsdd agin recreates all other above deleted files to eat the resources .<br>
<br>
Any fix available ?<br>
<br>
Thanks<br>
_______________________________________________<br>
Discuss mailing list<br>
<a href="mailto:Discuss@vlug.org">Discuss@vlug.org</a><br>
<a href="http://lists.vlug.org/mailman/listinfo/discuss" target="_blank">http://lists.vlug.org/mailman/listinfo/discuss</a><br>
</blockquote></div><br></div>