While reviewing other posts concerning this issue, I ran across information concerning how to check the system for an infection ..
Run either program:
verify the integrity of binaries
rpm -Va .
Confirm all root owned files that have the suid bit turned on. Any such file is executed as root, no matter who the user is. Use:
find / -perm 4755
A resulting file will have rwsr-x-r-x permissions. The "s" tells you the suid bit is turned on. Because it has execute by ANY users (the final r-x) it means any user can run it as root. I run the find for each of 4777, 4775, 4755 etc... - basically for any mode in which anyone other than the user (root) would be able to write the file (so no reason to search for 4744 because though it is readable by everyone else only root could write to it.)
Also to reset your passwords:
From GRUB boot menu, add to linux16 line ...
reset root password
reset user password
touch / .autorelabel
Also, found the Linux.Xor.DDoS trogan on affected systems. Still searching how to remove it. But, an effective way to keep it from getting in is using private keys.
If you also have an SSH server running make sure to set up key authentication with a strong password, then turn off just password authentication. This forces SSH to authentic witht the public/private keys you set up. Makes it next to impossible to brute force since the attacker won't have the appropriate key and the system will just drop the connection.
ssh-keygen -t rsa
Follow the instruction to enter a pass phrase and store the key into a file. Now copy the key to the computer you want to ssh to:
Finally, with the key transfered, you should be able to log in with:
To disable SSH password authentication:
cp sshd_config sshd_config.orig
Change the following settings