Time to time I'm getting alarmed that the server has high resource consumption after investigating the issue I found that there a process named xmr999 use the hole server CPU resources, I can't find any information about this xmr999,

same time the service provider send Abuse complaint regarding the server. the complaint is the server used to attack another server

I checked the server for backdoor or virus it showed clean

is there any advice regarding this xmr99, what is this or how can I block it?

enter image description here

Regards to all

  • Open a terminal. Update your question with the output of the command ps aux | grep -i [x]mr999 – souravc Apr 9 '19 at 2:35
  • After reboot, it disappears, the result of the command is nothing – AbuSaif Apr 9 '19 at 2:46
  • [root@nowodoo ~]# ps aux | grep -i [x]mr999 [root@nowodoo ~]# – AbuSaif Apr 9 '19 at 2:47

From another report: https://centos.org/forums/viewtopic.php?f=48&t=70067 it would appear your system is being used for bitcoin mining. If you aren't doing it then your system may have been hacked and someone else is using your computer to mine bitcoins.

| improve this answer | |
  • this what I thought, what the alternative way to remove or block it, to reinstall the system is not an option for me – AbuSaif Apr 9 '19 at 2:57
  • Whoah that's really creepy – Liso Apr 9 '19 at 3:03

From my experience, I can suggest these:

  • Check the crontab of the user running the process xmr999 with the following command:
    • crontab -l
    • If you see something suspicious there, follow that script and its folder.
    • In my case, I have found out that it was running a binary executable in a path /tmp/.tx/ every minute. I followed that path and there were some binary executables, one of which is xmr999. Additionally, there was a script updating crontab of the user.
    • If you find that kind of crontab, remove it and remove the corresponding scripts.
  • Check your sshd settings (/etc/ssh/sshd_config). It can be the reason that your computer has been compromised. If your password can be cracked via brute-force methods and your machine can be accessed via ssh password method, then you should disable ssh login via clear text passwords. I can suggest switching to key-based authentication for ssh and the following configuration changes on the sshd_config

    • PermitRootLogin no (Root user is not allowed to log in via ssh.)
    • PubkeyAuthentication yes (The authentication with public key is allowed, which is the default behavior.)
    • PasswordAuthentication no (The authentication with password is not allowed, which is the default behavior.)
    • PermitEmptyPasswords no (If the password authentication is allowed, the login for accounts with empty string passwords is not allowed, which is the default behavior.)

    • If you want more detail on the sshd config parameters, you can check its manual file with man sshd_config

  • Change password of your user(s) and the root user.

  • Check the listening ports for suspicious activites. You can do it via the following command:

    • netstat -tlnp
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.