# Perfctl malware attack
**URL:** https://forum.yunohost.org/t/perfctl-malware-attack/26326
**Category:** Advanced use case
**Tags:** english
**Created:** [September 11, 2023, 3:12pm UTC](https://forum.yunohost.org/t/perfctl-malware-attack/26326 "2023-09-11T15:12:53Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@kanhu](https://forum.yunohost.org/u/kanhu)
#### Post date: [September 11, 2023, 3:12pm UTC](https://forum.yunohost.org/t/perfctl-malware-attack/26326/1 "2023-09-11T15:12:53Z")
Hi,
I have been affected by perfctl malware.
It is eating up all the CPU.
Related topic: [Here is how I removed the perfctl malware](https://forum.yunohost.org/t/here-is-how-i-removed-the-perfctl-malware/23224)
On reddit: [Reddit - Dive into anything](https://www.reddit.com/r/debian/comments/12bkysm/need_help_getting_rid_of_malware_perfcc_perfctl/)
But unfortunately, the solution in the thread did not helped. It comes back after few hours.
Any help would be highly appreciated.
Thanks
---
### Author:  [@kanhu](https://forum.yunohost.org/u/kanhu)
#### Post date: [September 12, 2023, 1:28pm UTC](https://forum.yunohost.org/t/perfctl-malware-attack/26326/2 "2023-09-12T13:28:42Z")
Here are the steps to remove it.
THERE MIGHT STILL BE SOME TRACES OF IT LEFT IN THE SYSTEM.
I would recommend to perform a clean install.
1. Remove the paths virus added in the environment variables.
`vim /etc/profile`
Delete the `$PATH` /bin/.local/bin added by the virus program
2. Remove the daemon startup script added by the virus.
Delete the script from the /root/.bash\_profile. This script will trigger the execution of /usr/bin/perfcc when the root account logs in through SSH.
3. Remove the virus program.
`rm -rf /bin/.local`
`rm -rf /tmp/.perf.c`
Do `rm -rf` to all the mining files starting with **private** in tmp/ **private**.
` rm -rf /usr/bin/perfcc`
4. Kill all the virus processes. Use `lsof -i` to check the processes. They would be with httpd with strange foreign network connections. Kill the process and login through ssh again. Use systemctl status pid passes through the process tree. The parent process is the ssh tty that has just logged in. To accurately locate the virus process use ll /proc/pid, you would be able to see that the startup path of the process is /tmp/.perf.c/path.
Beware: After the process is started, the file is automatically deleted.
5. Remove the system service **kmodaudit.service**.
Delete the system service kmodaudit.service registered by the systemctl virus perfcc.
The service will actually be failing after deleting perfcc process.
---
### Author:  [@Mamie](https://forum.yunohost.org/u/Mamie)
#### Post date: [September 12, 2023, 1:32pm UTC](https://forum.yunohost.org/t/perfctl-malware-attack/26326/3 "2023-09-12T13:32:32Z")
Pro tip : if your system was infected, burn everything and restore it from scratch.
Let’s hope only the system was infected and not the apps and their backups.
Take great care not to restore user env as they might be impacted, and restore manually what you want to restore.
---
### Author:  [@jarod5001](https://forum.yunohost.org/u/jarod5001)
#### Post date: [September 12, 2023, 11:59pm UTC](https://forum.yunohost.org/t/perfctl-malware-attack/26326/4 "2023-09-12T23:59:42Z")
Did you find how it got in?
---
### Author:  [@kanhu](https://forum.yunohost.org/u/kanhu)
#### Post date: [September 13, 2023, 4:48am UTC](https://forum.yunohost.org/t/perfctl-malware-attack/26326/5 "2023-09-13T04:48:30Z")
Either from Wordpress or an unused ssh key from my stolen phone.