The problem is, that you remove it from one place, and due to the fact that it installs in other places as well, it just re-installs. The problem is, as montonero suggests, indeed in the function c
in the script.
To remove it from your system, look at:
/usr/local/bin/dns
/etc/crontab
/etc/cron.d/root
/etc/cron.d/apache
/var/spool/cron/root
/var/spool/cron/crontabs/root
/etc/ld.so.preload
/etc/cron.hourly/
/etc/cron.monthly/
/etc/cron.daily/
The last three will have a file called oanacroner
, that you must look at.
You may also look at function b
in the file and see which of the processes mentioned there are running (in the pkill
-lines and the ps aux | grep
-lines)
At the end of function b
, there are some services and communication with specific hosts that you will want to terminate as well. Even though it is not in this script, you will want to look at your inetd or xinetd config as well.
And finally, wget http://yxarsh.shop/0
and examine that one as well.
When you start cleaning, ifconfig down
your network interfaces.
Good luck.