My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets



Added to the Dr.Web virus database: 2023-10-07

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/rc2.d/K01rsyslog
  • /etc/rc3.d/K01rsyslog
  • /etc/rc4.d/K01rsyslog
  • /etc/rc5.d/K01rsyslog
Malicious functions:
Removes itself
Substitutes application name for:
  • (sysv-install)
Manages services:
  • ['systemctl', 'kill', 'rsyslog']
  • ['systemctl', 'disable', 'rsyslog']
  • ['systemctl', 'daemon-reload']
  • ['systemctl', 'kill', 'syslog']
  • ['systemctl', 'disable', 'syslog']
  • ['systemctl', 'kill', 'syslog-ng']
  • ['systemctl', 'disable', 'syslog-ng']
Launches processes:
  • bash -c svcadm disable syslog
  • dmidecode -s system-manufacturer
  • bash -c service stop syslog-ng
  • bash -c systemctl disable syslog
  • bash -c systemctl kill rsyslog
  • bash -c systemctl disable rsyslog
  • /bin/sh /usr/sbin/service stop syslog
  • bash -c service stop syslog
  • bash -c chkconfig off syslog
  • bash -c systemctl kill syslog
  • bash -c systemctl kill syslog-ng
  • bash -c chkconfig off syslog-ng
  • bash -c dmidecode -s system-manufacturer
  • /bin/sh /usr/sbin/service stop syslog-ng
  • /usr/bin/perl /usr/sbin/update-rc.d rsyslog defaults
  • bash -c service stop rsyslog
  • basename /usr/sbin/service
  • bash -c systemctl disable syslog-ng
  • bash -c chkconfig off rsyslog
  • /usr/bin/perl /usr/sbin/update-rc.d rsyslog disable
  • bash -c svcadm disable syslog-ng
  • /bin/sh /lib/systemd/systemd-sysv-install disable rsyslog
  • /bin/sh /usr/sbin/service stop rsyslog
  • getopt -o r: --long root: -- disable rsyslog
  • bash -c svcadm disable rsyslog

Curing recommendations


After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number