How to Remove a Cryptominer From Linux Safely

Phase 1: Identify and Isolate

• Check for unusually high CPU usage: Use commands like top, htop, or nmon to identify processes consuming excessive CPU.
• Examine running processes: Look for unfamiliar or suspicious processes that might indicate a cryptominer. Pay attention to processes with generic names or those running from unusual directories.
• Review network activity: Use netstat -tulnp or ss -tulnp to check for unusual outbound connections to mining pools or unknown IP addresses.
• Scrutinise log files: Check system logs in /var/log for any error messages or suspicious entries that might point to a cryptominer.
• Isolate the affected machine: Disconnect the compromised Linux machine from the internet to prevent further mining operations and communication with command-and-control servers.

Phase 2: Identify and Stop Cryptominer Processes

1. Identify the process ID (PID): Use ps aux | grep [process_name] to find the PID of the suspicious process.
2. Stop the process: Use the command sudo kill -9 [PID] to terminate the cryptominer process. Be sure to replace [PID] with the actual process ID.
3. Check for persistent processes: After stopping, run ps aux | grep [process_name] again to confirm the process is no longer running. If it restarts, it might be launched by a service or scheduled task.

Phase 3: Remove Malicious Files and Persistence Mechanisms

• Locate cryptominer files: Search for files associated with the cryptominer using commands like find / -name "[miner_executable]". Common locations include /tmp, /opt, /usr/local/bin, or hidden directories.
• Remove cron jobs: Check for suspicious scheduled tasks by running crontab -l for the current user and sudo cat /etc/cron* for system-wide cron jobs. Remove any malicious entries using crontab -e or by editing the relevant files.
• Disable systemd services: Look for unusual systemd service units in /etc/systemd/system/ or /lib/systemd/system/. Disable and remove them with sudo systemctl disable [service_name] and sudo rm [service_file].
• Check for startup scripts: Examine /etc/rc.local, /etc/init.d/, and user-specific startup files in ~/.bashrc, ~/.profile, or ~/.config/autostart/ for suspicious entries.
• Delete malicious files: Once identified, remove these files using sudo rm -rf [file_or_directory_path]. Be extremely careful with this command.

Phase 4: Post-Removal Cleanup and Security Hardening

1. Update all software: Ensure your operating system and all installed software packages are up to date using sudo apt update && sudo apt upgrade (for Debian/Ubuntu) or equivalent commands for your distribution.
2. Change all passwords: Assume any credentials stored on the compromised system may have been exposed. Change passwords for user accounts, SSH keys, and any services accessed from the machine.
3. Review firewall rules: Verify your firewall (e.g., ufw status or firewall-cmd --list-all) to ensure only necessary ports are open.
4. Install a reputable antivirus/anti-malware scanner: Consider using tools like ClamAV to perform a full system scan.
5. Monitor system performance: Keep an eye on CPU usage, network activity, and system logs to confirm the cryptominer has been completely eradicated and no new suspicious activity emerges.
6. Consider a fresh installation: For critical systems or if you are unsure about the completeness of the removal, a reinstallation of the operating system is the safest option.