2 Mar
2021
2 Mar
'21
14:31
On Tue, Mar 02, 2021 at 03:27:23PM +0100, Josef Moellers wrote:
On 02.03.21 15:17, James Knott wrote:
Today, I noticed my computer performance was very poor. Top showed something called .dhcpd running under user test and using almost 400% of my CPU. In ~/test, I found an executable .dhcpd. I have not used the test account for a long time. That .dhcpd also survived a reboot, so I'll have to determine how it's starting. You can have a look at what it's actually doing with "strace": strace -f -p $(pidof .dhcpd)
Also, have a look if it has any suspicious strings (attached ;-) ): strings .dhcpd
Sounds definitely malware if you did not put it there. Let me guess the test user has password "test"? Ciao, Marcus