I have a Server installed with Ubuntu 16.4.5 LTS. When I check crontab, there is a script that download from anonymous website and run the script.

I try to remove the schedule but the script installed again in crontab.

This is the script that downloaded from crontab. can you tell me what is the name of this script and how to remove from my server.

crontab list

script file


The problem is, that you remove it from one place, and due to the fact that it installs in other places as well, it just re-installs. The problem is, as montonero suggests, indeed in the function c in the script.

To remove it from your system, look at: /usr/local/bin/dns /etc/crontab /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/ld.so.preload /etc/cron.hourly/ /etc/cron.monthly/ /etc/cron.daily/

The last three will have a file called oanacroner, that you must look at.

You may also look at function b in the file and see which of the processes mentioned there are running (in the pkill-lines and the ps aux | grep-lines)

At the end of function b, there are some services and communication with specific hosts that you will want to terminate as well. Even though it is not in this script, you will want to look at your inetd or xinetd config as well.

And finally, wget http://yxarsh.shop/0 and examine that one as well.

When you start cleaning, ifconfig down your network interfaces.

Good luck.

  • wow... that is a detailed step to solve this issue. i'll try it. thx – Zuhri Utama Mar 5 at 2:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.