How do I deal with a compromised server?
I did a scan on my entire vps finding the folder above with a good amount of viruses. Can I safely delete this folder? Can I through ssh or is there a way I need to do it through the command line?
/tmp/.xzibit/new64: UNIX.Exploit.CVE_2010_3301-2 FOUND /tmp/.xzibit/c/robert_you_suck.c: UNIX.Exploit.CVE_2010_3301-1 FOUND /tmp/.xzibit/ab: UNIX.Exploit.CVE_2010_3301-1 FOUND /tmp/.xzibit/3/ptrace: Linux.RST.B-1 FOUND /tmp/.xzibit/3/ptrace24: Linux.Rst.A FOUND /tmp/.xzibit/3/elf: Exploit.Linux.Race.C FOUND /tmp/.xzibit/3/brk: Linux.Brk.B FOUND /tmp/.xzibit/3/90: Linux.Osf.3974 FOUND /tmp/.xzibit/3/ex: Linux.RST.B-1 FOUND /tmp/.xzibit/3/x: Linux.RST.B-1 FOUND /tmp/.xzibit/3/ee: Linux.RST.B-1 FOUND /tmp/.xzibit/3/nc: Linux.Rst.A FOUND /tmp/.xzibit/3/e2: Linux.RST.B-1 FOUND /tmp/.xzibit/3/uselib24: Exploit.Linux.Race.C FOUND /tmp/.xzibit/1/32/therebel/exploit.c: Exploit.Linux-2 FOUND /tmp/.xzibit/01: UNIX.Exploit.CVE_2010_3301-2 FOUND
Addl info: I've noticed the websites on this compromised in the past, scanned and cleaned. This was the first time i decided to scan everything, rather than just the web directory. This is the only thing coming up, which would lead me to believe it is leftover junk that I missed before and came from one of the sites (since it is still only stuck in the tmp dir). Would this be accurate to assume?