0
guest-kpjg0a:x:999:999:Guest:/tmp/guest-kpjg0a:/bin/bash

I have checked /etc/passwd, then here it is. Am I hacked? Yes, I am hacked.

Smile
  • 1,129

2 Answers2

0

There's probably nothing to worry about, this looks like a temporary guest account. They are normally removed upon logging out. Malware is unlikely in my opinion, but can't be ruled out without more information.

shaggyrogers
  • 34
0

If you are concerned, you can check out your logs to see what that user has been up to (/var/log/auth.log, etc...) as well as verify the groups/permissions it has (id ).

Finally I was verify any network weirdness like outbound connections (netstat -nap)

Anything amiss and I would blow it away.