Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Linux.Siggen.517

Added to the Dr.Web virus database: 2018-04-05

Virus description added:

Technical Information

Malicious functions:
Gains root privileges
Launches processes:
  • /usr/bin/chsh -s /bin/sh
  • nscd -i passwd
  • nscd -i group
Performs operations with the file system:
Modifies file access rights:
  • /etc/passwd+
Creates symlinks:
  • /etc/passwd.lock"
Creates or modifies files:
  • /root/sendfile1
  • /root/kmem
  • /etc/.pwd.lock
  • /etc/passwd.694
  • /etc/passwd-
  • /etc/passwd+
  • /etc/passwd.699
Deletes files:
  • /etc/passwd.694"
  • /etc/passwd.lock"
  • /etc/passwd.699"
Network activity:
Awaits incoming connections on ports:
  • 0.0.0.0:31337
Establishes connection:
  • 0.0.0.0:31337
Receives data from the following servers:
  • 127.0.0.1:39962

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number