[PLUG] malware cont'd

[jeff <jeffv@op.net>]

took me a while to make sure I was firewalled correctly (logs show it 
keeps trying different ranges). They were all stopped at SYN. Back to 
finding the source, I checked PROC/pid and found a bizarre assortment of 
zero byte files, symlinks, and recursive dirs, not to mention a 29g 
mirror of my HOME dir. Could not find anything that called it into 
existence in these dirs. (Thanks, Michael)

pstree(?) showed the fake processes came directly from systemd - top 
level. Is there a way to tshoot from there? Can't find it in logs.

Tomorrow it's a new install and lighting a candle to the Flying 
Spaghetti Monster to make sure my data is clean.

Tks.

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug