<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">For a quick fix, you can update your firewall to block all traffic to/from 198.50.168.213.<div class="">—Michael<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jan 11, 2023, at 5:37 PM, Grand Rapids Linux Users Group <<a href="mailto:grlug@grlug.org" class="">grlug@grlug.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Figure out what user the script is running under.<br class="">Look at the home directory and see if there is an executable named `htop` in there, because I wouldn't normally expect to see it there.<div class="">I'm quite confident someone uploaded a crypto miner and renamed it `htop` as to disguise it.</div><div class=""><br class=""></div><div class="">Regarding the IP address 198.50.168.213, that IP resolves to the domain name <a href="http://mine.zpool.ca/" class="">mine.zpool.ca</a> which IS a crypto mining service.</div><div class="">More on that IP available here:</div><div class=""><a href="https://www.abuseipdb.com/check/198.50.168.213" class="">https://www.abuseipdb.com/check/198.50.168.213</a><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 11, 2023 at 5:27 PM Grand Rapids Linux Users Group <<a href="mailto:grlug@grlug.org" class="">grlug@grlug.org</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Wed, 11 Jan 2023, Grand Rapids Linux Users Group wrote:<br class="">
<br class="">
> Looks like crypto mining scripts running on your machine.<br class="">
><br class="">
Plausible, .. how would one locate them? Don't see anything weird in ps.<br class="">
<br class="">
TFTR!<br class="">
-- <br class="">
grlug mailing list<br class="">
<a href="mailto:grlug@grlug.org" target="_blank" class="">grlug@grlug.org</a><br class="">
<a href="https://shinobu.grlug.org/mailman/listinfo/grlug" rel="noreferrer" target="_blank" class="">https://shinobu.grlug.org/mailman/listinfo/grlug</a><br class="">
</blockquote></div>
-- <br class="">grlug mailing list<br class=""><a href="mailto:grlug@grlug.org" class="">grlug@grlug.org</a><br class="">https://shinobu.grlug.org/mailman/listinfo/grlug<br class=""></div></blockquote></div><br class=""></div></body></html>