My Debian 8.5 (x64) server is infected with a rootkit, which I have detected by using a live CD to display the contents of
I found out about the infection by seeing high CPU loads due to a cryptominer.
The above directories contain binaries that
ls does not display, when the system is running - I guess, the rookit is intercepting system calls?
I've already runned
lynis, but without any results, except warnings (changed) about:
kernel.core_uses_pid kernel.dmesg_restrict kernel.kptr_restrict kernel.sysrq kernel.yama.ptrace_scope
I want to achieve:
- Locate the rootkit.
- Remove the rootkit (if possible).