Re: Hacked
Andrea Beducci <[email protected]>
| Newsgroups | gmane.comp.lang.ruby.general |
|---|---|
| Message-ID | <[email protected]> |
Hi, you can delete the tmp folder contents without problems and check if there's a script in your server that generate it. You can scan the folders with a server antivirus or some other tools to find unconventional commands. Andrea Beducci Inviato da iPhone > Il giorno 13 feb 2019, alle ore 14:37, Peter Hickman <[email protected]> ha scritto: > > Some of my servers have been hacked and running a monero(?) coin miner. It creates a directory called /tmp/systemd-private-60ffef34724f43b19fa2d3962b83687e-systemd-timesyncd.service-sPMHHT (or similar) > > Also at the same time a /tmp/bundle directory is created > > Do these seem related? Does anyone have an idea on this? > > > Unsubscribe: <mailto:[email protected]?subject=unsubscribe> > <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk> Unsubscribe: <mailto:[email protected]?subject=unsubscribe> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk>