-1

I have two processes that start automatically and when that happens the internet speed decrease considerably. I tried to killed those processes but they start again, I tried to delete the executables too that are located at /boot/pro and /boot/proh, but they are recreated again.

I made the following script to kill constantly those processes as a workaround, but this is a temporal solution.

while true ; do killall proh ; done

I am on Debian 7. I don't know who is executing constantly those processes.

Does anybody think they can help me?

  • 1
    This sounds fishy. I'd consider the possibility of being attacked and maybe reinstall. – phunehehe Apr 28 '14 at 1:42
  • 2
    I'd backup and reinstall the system, it might have been hacked. Usually binaries (except for the kernel) aren't in /boot and don't reappear by themselves. – Renan Apr 28 '14 at 1:51
  • 3
    Might have been? That's a pretty blatant compromise there. Nuke it from orbit, it's the only way to be sure. – Michael Hampton Apr 28 '14 at 2:44
  • 1
    Re-install. There's little any of us can do to help you here. This issue when I googled turns up literally nothing. – slm Apr 28 '14 at 2:52
  • I will do a strace to know what is happening. I don't want to reinstall. Thanks to all. – Gabriel Apr 28 '14 at 19:52
5

We see this kind of question on ServerFault all the time. Unless you're a Past-Master Neckbeard, and unlikely to be so if you're asking this question, just nuke it and re-install. And next time lock down your install.

Here's some good ideas to start with on that front.

a) Good passwords. Don't use easily guessable passwords. In fact, avoid using dictionary words in your passwords at all. Mine's a nice long 20-character string that can't be guessed without brute force, and longer than most rainbow lists. It lives on a post-it note in my office and backed up in a USB key in the lockbox. If someone has physical access to your box, software security means just about nothing except how long it takes for them to get your data.

b) Certificates > Passwords. Tie your accounts to certificates instead of just passwords, and then disable Password-Only Authentication.

sshd_config: PasswordAuthentication no

c) Turn off root logins via SSH. This way that can't simply brute force your root account on your install. The AllowGroups or AllowUsers directive is your sshd_config is an excellent way to do this.

d) Lock down your open ports. Many distributions run a default ACCEPT policy. That means that any system that can route to your install will be able to initiate connections to any running service. Run a default REJECT and selectively enable services you want to be available. IPTables/Netfilter is the classic means of doing this. Some distributions some a GUI or "TUI" ASCII-GUI tool to manage this. Some, including the ones most often running ACCEPT ALL, have easier to use X/Windows GUI tools like UFW for Ubuntu.

e) Once you've done ALL these things, then consider something like Fail2Ban to rate limit SSH connections. Once a system makes a configurable number of failed connections, it can go in the penalty box for a defined period of time.

0

I found this file "/etc/init.d/DbSecuritySpt" who executes "/boot/pro". I researched this and found the following:

http://blogg.openend.se/2014/3/2/malware-under-linux

https://github.com/ValdikSS/billgates-botnet-tracker

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.