Centos 7 keeps uploading

[alex4020]

Hello Everyone,
I have installed Centos server with GUI and now i am stuck as the moment i turn on the machine it keep uploading data above 1G.

Please advise how to stop this.

Thank you.

[TrevorH]

If you've just installed it then the easiest thing would be to reinstall. If you have data on it already then you will probably still end up needing to reinstall if the source of the compromise turns out to be as root.

Pull the network cable and fire it up and start looking for how they got in, what they did and how to stop it for next time. Your current install may already be beyond repair - if it's been compromised and they have root access then the only safe thing to do is to wipe it and reinstall.

[alex4020]

Hello,
Than you for your reply.

Problem is I have loaded a server on the machine already so re-installing entire CentOS will be a big task to rebuild the server.

I have now managed to stop the data upload, looks like I was a victim of mail spam.

Next problem arises.... .xmrig miner is running in background and all cores are running at 100%

How do I stop/remove .xmrig??

Please help.

[desertcat]

Hello,
Than you for your reply.

Problem is I have loaded a server on the machine already so re-installing entire CentOS will be a big task to rebuild the server.

I have now managed to stop the data upload, looks like I was a victim of mail spam.

Next problem arises.... .xmrig miner is running in background and all cores are running at 100%

How do I stop/remove .xmrig??

Please help.

Just a trivial question: Are you running a cryptocurrency mining operation? If you are "mining", then yes all your cores will be running at 100%, otherwise I have no idea why you have xmrig miner running. It is an open invitation for adware, malware, and other nasty things.

Trevor is right, your best bet to to simply do a reinstall of the entire OS even if it is a giant PITA as you have no idea what exactly was compromised, what data is now already in the wild, etc. You also need to harden your server.

If you plan on running a cryptocurrency mining operation you don't run it anywhere near, let alone on, your network as it is an open invitation for hackers -- you definitely don't run it on your server. Run it as a standalone app. If you plan on mining and hope to make money you will need several nodes doing the full tilt boogie... unless you happen to be one of those people who buys a lottery ticket and wins $100 million on a $2.00 ticket.

When you do your re-install for God's sake don't download .xrig miner, and make sure you use a strong root password and a strong user's password, otherwise you are just begging to be owned.

[alex4020]

No.. I am a victim here.

All I did was installed a clean CentOS and boom after a weeks time I was slammed with all these.

Alright so looks like a clean install is the solution.

Thanks guys.