Help with BASH scripting

scasey · 05-24-2017, 11:38 PM

Quote:

Originally Posted by krazybob

Umm.. I'm not cross posting. I posted in Servers.

Not what I meant, my bad. Was only talking about how you and I and Turbocapitalist were all posting at the same time.

Quote:

Originally Posted by krazybob

They uploaded javascript and symlinked sendmail to another MTA. I don't know how to reverse it.

Code:

lrwxrwxrwx 1 root root 21 Jan 10  2010 sendmail -> /etc/alternatives/mta

I think it's just

Code:

rm /path/to/symlink/sendmail

but I note:

Quote:

Originally Posted by krazybob

Code:

lrwxrwxrwx 1 root root 21 Jan 10  2010 sendmail -> /etc/alternatives/mta
-bash-3.2 clss03 # cd /etc/alternatives/mta
-bash: cd: /etc/alternatives/mta: Not a directory
-bash-3.2 clss03 # cd /etc/alternatives/   
-bash-3.2 clss03 # ls -lah
total 8.0K
[snip]
lrwxrwxrwx  1 root root   23 Jan 12  2010 mta -> /var/qmail/bin/sendmail
[snip]

so it is using your MTA (qmail, right?) So you can stop sending out spam with

Code:

qmailctl stop

(!) [If you *firefighting]
Then, kill the /etc/init.d processes, rm the /etc/alternatives directory and files,
[stopping to see what you just posted...]

Turbocapitalist · 05-24-2017, 11:50 PM

Quote:

Originally Posted by krazybob

Code:

        /usr/bin/adsosqsdxj

Physically removing the cable is the best option if possible. That program can have launched something else that you can't find easily or quickly.

If you are not able to physically remove the network cable, then I'd look for processes named "adsosqsdxj" and kill them. The script they put on your machine will not stop anything even if told to, so you'll have do it by hand. This would be one of the few instances where SIGKILL ( -9 ) is needed:

Code:

pgrep -lf adsosqsdxj
pkill -9 -x adsosqsdxj