Possibly infected passwd file?

[br5dy]

Can someone please post an ORIGINAL /etc/passwd file that VestaCP installer sets up? After this recent infection, I'm seeing some new users that look suspicious. Thanks!

Here's what my file looks like. Anything look suspicious??? I've obfuscated known users.

[yoko eagle]

Can someone please post an ORIGINAL /etc/passwd file that VestaCP installer sets up? After this recent infection, I'm seeing some new users that look suspicious. Thanks!

Here's what my file looks like. Anything look suspicious??? I've obfuscated known users.

You can do fresh install yourself and then compare the files.
I think no one will post their password file here.

[br5dy]

Okay, FYI, anybody else noticed RSYSLOG being installed or is this part of VestaCP?

I went ahead and disabled it using these instructions. Not sure if this is a third party service that uses this or if the trojan was sending syslog data to a remote server....

[skamasle]

Why you think is infected ?

If you have all in false or no-login shell no access from ssh can be made from that users