How to remove camplz virus on ubuntu

Question

I have noticed a virus on our machine. Symptoms it shows are

1. It runs multiple process with the name camplz. If I kill the process it restarts
2. The executable is present under /usr/bin directory. If I delete the executable it gets recreated.
3. It creates files under /tmp with name config.f and ??af???a???mdkkkk.

4. If I delete the files, they are recreated It ESTABLISH IP connections to China based IP addresses and starts sending bytes in MB, increasing my bandwidth utilization.

   lsof -o shows camplz  26983    root    2u  IPv4 2380650457      0t0  TCP <mydomain.com>:18703->100.42.227.29:18888 (ESTABLISHED)
   

mydomain.com is a placeholder.

Although, I have found the source, I do not have idea on how to remove it and clean my machine. I do not want to change machine as much as possible. At present, I have written a simple script that kills the process and deletes the files created. This helps. However it is not a permanent solution. I used few virus scanning software. But they do not catch. Can someone suggest a solution.

    #!/bin/bash

    while true; do ps -ef | grep camplz | grep -v grep | awk '{print $2}' |  xargs kill; rm /usr/bin/camplz ; rm /tmp/config.f ; rm /tmp/??af???a???mdkkkk ;  done

Answer 1

Friends, Monitored the system last night and found it stable. Thought of sharing my experience on how the problem was solved.

Problem statement Got email from hosting provider that bandwidth usage has increased multifold.

Hunting for source

1. Ran iftop -n to find out the flow of data. Clearly my machine was sending data out.
2. Ran lsof -i and lsof -o to find out which process are sending data out.

3. Got the PID from output of lsof -o

4. Ran ps -e -o cmd,pid,ppid | grep <pid> to understand the parent process id. It was found to be 1

5. Ran grep -rnw '/' -e "camplz" to find out all the files that had presence of name of the process
6. Opened the files to read how the scripts were behaving
7. Ultimately deleted all the infectious files and killed their running process

More specific information points are in the comments. I believe they could defer for individuals though.

Wrote few scripts during this process. Hope you find them useful.

Script to kill the process whenever it appears

    #!/bin/bash

    while true; do ps -ef | grep camplz | grep -v grep | awk '{print $2}' |  xargs kill; rm /usr/bin/camplz ; rm /tmp/config.f ; rm /tmp/??af???a???mdkkkk ;  done

Script to monitor bandwidth usage and send email in case it jumps

    #!/bin/bash
    log="/root/net.log"
    current_time=$(date "+%Y.%m.%d-%H.%M.%S")
    if [ -z "$1" ]; then
            echo
            echo usage: $0 network-interface
            echo
            echo e.g. $0 eth0
            echo
            echo shows packets-per-second
            exit
    fi

    IF=$1

    while :;
    do
            R1=`cat /sys/class/net/$1/statistics/rx_bytes`
            T1=`cat /sys/class/net/$1/statistics/tx_bytes`
            sleep 10
            R2=`cat /sys/class/net/$1/statistics/rx_bytes`
            T2=`cat /sys/class/net/$1/statistics/tx_bytes`
            TXPPS=`expr $T2 - $T1`
            RXPPS=`expr $R2 - $R1`
            echo "tx $1: $TXPPS bytes/s rx $1: $RXPPS bytes/s"
                    if [ "$TXPPS" -gt 100000000 ]; then
                    mail -s "Data is being transmitted above 100 MB. Please Check" <put your email id here. e.g. me@mycompany.com> < /dev/null
                            echo "$current_time Mail send successfully" >>$log
                    fi
    done

Thanks to @mikewhatever @DopeGhoti and special thanks to @Serg