Been Hacked!

How to clean a Hacked CentOS / LINUX Machine

yum install chkrootkit

Run chkrootkit to find INFECTED files

You will need to delete, manually, each of these files.

The permissions will be modified to stump the average user.

You will need to use: chattr

This command will free most files:

chattr -suSadAc

For the ones that can not be deleted after the above, try: chattr -i

Files commonly targeted: top ps find netstat ifconfig

Once the files are deleted, reinstall the files using YUM:

yum reinstall procps openssh-server openssl psmisc findutils fileutils util-linux net-tools textutils sysklogd

Additional things:

1. sshd will be renamed to sshd0 in /usr/sbin/

2. the hacker has most likely added an entry to the bottom of: /etc/rc.d/rc.sysinit

———

# Xntps (NTPv3 daemon) startup..

/usr/sbin/xntps -q

———

Remove it: chattr -suSadAc xntps ; rm -f xntps

3. Re-run chkrootkit until the machine is clean