I scanned using ClamAV and found these files:

[root@ip-172-31-23-37 ~]# sudo clamscan --infected --recursive --exclude-dir="^/sys" /
/tmp/.X25-unix/dota3.tar.gz: Multios.Coinminer.Miner-6781728-2 FOUND
/tmp/.X25-unix/.rsync/a/kswapd0: Multios.Coinminer.Miner-6781728-2 FOUND

I already deleted these files and also the parent folder but the process still running:

31107 root      20   0 1304592   1.1g   6960 R  98.0 31.2  44:22.94 clamscan
 2474 root      20   0  714000 267428   2896 S  50.0  7.0   0:09.11 kswapd0
28253 1008      20   0  712144 264716      0 S  50.0  7.0   2290:36 kswapd0

Tried to kill its:

[root@ip-172-31-23-37 /]# ll /proc/2474/exe
lrwxrwxrwx 1 root root 0 Dec 10 16:36 /proc/2474/exe -> /tmp/.X25-unix/.rsync/a/kswapd0 (deleted)
[root@ip-172-31-23-37 /]# killall kswapd0
[root@ip-172-31-23-37 /]# pidof kswapd0
[root@ip-172-31-23-37 /]# kill 432
[root@ip-172-31-23-37 /]# kill -9 432
[root@ip-172-31-23-37 /]# pidof kswapd0
[root@ip-172-31-23-37 /]# ll /proc/432/exe
ls: cannot read symbolic link /proc/432/exe: No such file or directory
lrwxrwxrwx 1 root root 0 Dec 10 16:37 /proc/432/exe
[root@ip-172-31-23-37 /]# killall kswapd0
[root@ip-172-31-23-37 /]# killall kswapd0
[root@ip-172-31-23-37 /]# killall -9 kswapd0
[root@ip-172-31-23-37 /]# killall -9 kswapd0

The process still exist even killed so many times. How to force kill that and prevent back/running again?

  • 2
  • @ArtemS.Tashkinov thanks, but I already read it, and it can not help above case – Muhammad Dyas Yaskur Dec 10 '20 at 17:09
  • 1
    The point is that trojans often re-execute themselves as soon as they detect that they've stopped running. You likely also have at least one other process running (likely more). You can't fix this. You don't even know what other binaries and files (configurations etc.) have been replaced by your intruder. It's not your machine any longer. Everything that you do with it now is owned by someone else, including passwords etc. Consider reinstalling. – Kusalananda Dec 10 '20 at 20:00
  • @Kusalananda if re-execute, usually with new pid id, isn't it? the pid id is always same 432 even if I restart my machine. But ok then, Actually this instance is my client's server, has so many projects which use bad practice scheme. So I think will be nightmare to reinstall again. – Muhammad Dyas Yaskur Dec 11 '20 at 0:51
  • 1
    By the same metric, it will be a nightmare to clean your client's server up to be able to guarantee that there is no ongoing privacy/data breach. – Kusalananda Dec 11 '20 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.