Who faced the vulnerability mining cryptocurrency?

Question

linux

On a couple of servers with different kernels, different versions of ubuntu, 16.04 and 18.04, some garbage was found that loads a percent. Run
from root, has different names like ptV9Tp
From what was found - in the crontab from root, the systemd call, in / tmp - .XIM-unix files, in which the uid of the bash process and the ptV9Tp itself
and in /lib/systemd the systemd-login file with the bash call
how to treat this nonsense
, the process hangs explicitly connected to the ptV9Tp pool
15244 root 0u IPv4 2329155943 0t0 TCP 41-04.webazilla.com:51200-> server.pol-ice.ru:http-alt (ESTABLISHED)

Answer 1

Oh, this protected Linux, under which there are NO VIRUSES!11 .
Do:
If there is no path to the program, then:
And delete.
Get more updates.