HOW TO: How to clear the server from ChachaDDoS

[imperio]

Here is what's needed to be done
1. Find and remove dhcprenew binary from the system

Code: Select all

find /etc -name "*dhcprenew*"
find /usr/bin -name "*dhcprenew*"

2. Stop running process named as kworker and launched between 24-28 Sept

Code: Select all

ps auxf

3. Run rkhunter script to make sure there is no other affected binary files

Code: Select all

apt-get install rkhuner
yum install rkhuner
http://rkhunter.sourceforge.net/
rkhunter -k

4. Change current password for admin and root user

Or you can spin up another server and migrate your users using following doc
http://vestacp.com/docs/#how-to-migrate ... her-server

For more information about this trojan please read
https://www.welivesecurity.com/2018/10/ ... installed/

5. That's all