JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.826
Added to the Dr.Web virus database:
2018-07-31
Virus description added:
2018-07-31
Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
/sbin/dhclient-script
run-parts --list /etc/dhcp/dhclient-enter-hooks.d
ip link set dev eth0 up
run-parts --list /etc/dhcp/dhclient-exit-hooks.d
ip -4 addr add 192.168.210.50/255.255.255.0 broadcast 192.168.210.255 dev eth0 label eth0
ip -4 route add default via <LOCAL_GATE> dev eth0
rm -f /etc/resolv.conf.dhclient-new
chown --reference=/etc/resolv.conf /etc/resolv.conf.dhclient-new
chmod --reference=/etc/resolv.conf /etc/resolv.conf.dhclient-new
mv -f /etc/resolv.conf.dhclient-new /etc/resolv.conf
Performs operations with the file system:
Modifies file access rights:
/etc/resolv.conf.dhclient-new
Creates or modifies files:
/var/run/dhclient.pid
/run/dhclient.pid
/var/lib/dhclient/dhclient.leases
/etc/resolv.conf.dhclient-new
Deletes files:
/etc/resolv.conf.dhclient-new
Network activity:
Awaits incoming connections on ports:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK