Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
758
Views
Topic starter
24/09/2018 9:07 am
I suspect my web / ftp Linux server has rootkit, I found my cron job with new *.sh file created, so I cleared it, but after few days, cron job directory is fine, but under bin, sbin, there are more than 10 new executable generated, I deleted them, but few days later, they come into etc/rc various folder, thus my question is besides cron tab, is there any other places that rootkit can maintain persistency? how they maintain? thanks
24/09/2018 10:00 am
Check the system for any services that you don't recognize (using systemctl or similar)