Malware Issue

Malware Issue faced and rectified on Linux Mail Servers

Symtoms

  1) Load will gradually rise.
  2) CPU Utilization will rise.
  3) Both became stable at a level(around 20 load)
  4) Wierd applications would found running when you monitor TOP. 

Steps to find out the location of malware

  1) Monitor cpu usage using TOP command
  2) Any service which is using CPU around 200% , monitor that service. 
  3) Using ps -elf | grep "--service name--"   , find out wether the service is genuine or froud. 
  4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp  or at /root/ or / ) 
  

Steps to secure our machine

  1) First of all kill that process using its PROCESS ID( mind that you use its PID)
  2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate. 
  3) Then echo > --malware--  ( empty the contents of malware fle)
  4) Then chmod 000 --malware-- 
  5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)

For help - malware are basically of names like - a,b,meep.sh,xd.pl,minerd,minerd32,minerd64,kpoll,fuss. and are found 80% of times at /var/tmp/