Q: Malware ( cpubalence ) - information and removal It seems I have a Linux host ( CentOS ) infected with some kind of malware.
There is an executable called cpubalence which has been created in /tmp/. It seems to start itself up and consume 100% CPU making the host very slow.
I can easily terminate the PID and then rm the culprit file, but it just returns after a day or so. I don't see any entries in crontab that are starting it.
I'm not really sure what else I should do, is there any advice. Searching on Google doesn't seem to find much related to "cpubalence" however I did find a file listed as malware called "cpubalance" which was the same filesize. ( Different MD5 though ).
I have run clamscan and it detects the file as: 


*

*/tmp/cpubalence: Unix.Malware.Agent-1755468


I did scan the whole PC and it also found:


*

*{SNIP}/sshd: Unix.Trojan.Agent-37008 FOUND

*{SNIP}/jbudp: Unix.Trojan.Agent-37008 FOUND

*{SNIP}/console.war: Java.Malware.Agent-1775460 FOUND


Console.war is a Java file related to opensource software that I am using on the host, it didn't show up originally on my scan but now ( a few days later ) it shows up as infected file. Is it possibly a red herring?
I will most likely rebuild the machine as that will be the safest option to ensure the threat is removed. However I'd like to obviously know more about what I've been infected with and how it happened.

A: As you say, rebuilding the system from a clean OS is the way to go. Now that the system is compromised, you can't trust it.
What else should you do? Remove it from the network immediately. It is probably using 100% CPU because it is doing DDoS (distributed denial of service) attacks, or scanning networks to find more systems to attack, both of which can harm other systems. The longer you leave this system up and connected to a network, the more damage the malware can cause: to you and to others.
I don't know this specific malware you're talking about, I'm just giving you general advice having seen recent attacks like this.
Java web applications seem to be a popular target these days, so whatever console.war is may have been the initial vector. If this web application is exposed to the internet, do not simply start running it again on your clean reinstalled system -- you may just get compromised again.
You say it is a part of some open source software -- check for security updates for this software. It is likely (but not certain) that whatever flaw the attacker took advantage of has already been fixed. And remember: any web application accessible to the internet must be kept up to date with security patches, or it will be found and exploited.
Also, the fact that your scanner suspects sshd is troubling. If an attacker can compromise the ssh daemon, they usually use it to record passwords when users log in remotely using ssh. If you or anybody has connected to this system via ssh and logged in with a password, you should assume that the password has been compromised and change the password immediately.
Good luck. Hopefully this incident has not caused major damage, and you can use this opportunity to secure your system and avoid future problems.

A: this happened to me too.
I found out that the attacker was using my postgres server to create the files on /tmp through a function on public schema.
I recommend to migrate databases to another server and change default passwords on the new enviroments.
