July 10, 20232 yr Hi All, Could use some help. I stupidly had my unraid sever accessible via internet, i've already shut down that access and those ports. But a bad actor has gotten in and I have xmrig being run every few minutes. If I kill the process it just starts back up in 5ish minutes. Not sure how I can find out what is launching that command. It doesn't appear to be any docker I'm running , but I think they've slipped something somewhere on my system that is running that command every few minutes. I've checked cron.d and I don't see anything there either. Any help would be greatly appreciated. tower-diagnostics-20230710-1140.zip
July 10, 20232 yr Community Expert Solution Remove the "tor" line and the last one in /config/go and what has recent file dates in the /config/wireguard folder on the flash drive, or everything if you're not using wireguard Reboot Do a "which tor" in terminal and see if there's still something
July 10, 20232 yr Author Thanks so much, after removing tor from /config/go and removing all files in /config/wiregaurd it xmrig has not shown up again. Running "which tor" returned a result of /bin/tor still even after removing the above and rebooting
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.