0

I found this script is running in my system without any knowledge.

#!/bin/sh
if test -r /tmp/.txl/bash.pid; then
pid=$(cat /tmp/.txl/bash.pid)
if $(kill -CHLD $pid >/dev/null 2>&1)
then
sleep 1
else
cd /tmp/.txl
./run &>/dev/null
exit 0
fi
fi

Also this script is being triggered by /tmp/.txl/upd >/dev/null 2>&1

Can anyone explain why this script is running

Any help will be appreciated..!

Manikandan Ram
  • 389
  • 1
  • 14
  • 1
    That script is little more then a wrapper around the "./run" script or program. We would need to know what that script is doing to advise. – davidgo Dec 14 '19 at 19:07
  • If you don't know why the script exists on the system, it means that it was installed by exploiting a vulnerability on your server. You need to restore the server from clean backups and make sure all your software is updated. – Tero Kilkanen Dec 15 '19 at 15:08

0 Answers0