Challenge 12: Malware Aftermath Cleanup - ChristopherJamesMorton/Nice-Challenge-Solutions GitHub Wiki

I noticed Fileshare was the only logical connection from the MSP within our network and logged into that box (Fileshare) and found many unknown processes (freesweep_scores) running from that machine.

From Fileshare run the following commands:
sudo mkdir -p /tmp/virus
sudo mv /usr/games/freesweep_scores /tmp/virus

Retrieve files from Security-Desk:
scp 172.16.30.100:/tmp/virus* /home/playerone/Desktop/quarantine/

sudo deluser lpena

sudo mv /usr/games/freesweep_scores /tmp/virus

remove freesweep_scores from /etc/crontab Before:

After: