Close the propped-open windows
After cleaning up the attacker's account, you still need to make sure they cannot wander back in. The attacker left two pieces of auto-start behind on this machine:
- a fake systemd service called
sysupdate(plus the link that makes it start on boot), and - a script dropped into
/etc/profile.d/that runs at every login.
Find them, confirm the service name, and remove all of it.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
List the services with `ls /etc/systemd/system/` and read anything unfamiliar with `cat`.
Delete the `.service` file and its matching link in `multi-user.target.wants/`, then clean `/etc/profile.d/`.
Solution explanation
You found the attacker's two ways back in. The sysupdate service looked official but its ExecStart opened a network connection — and the link in multi-user.target.wants/ is what made it start on every boot, so you removed both. The file in /etc/profile.d/ would have run at every login, so that went too. systemctl daemon-reload tells systemd to forget the unit you deleted. The window is shut.
Show solution
ls /etc/systemd/system/
cat /etc/systemd/system/sysupdate.service
sudo rm /etc/systemd/system/sysupdate.service /etc/systemd/system/multi-user.target.wants/sysupdate.service
ls /etc/profile.d/
sudo rm /etc/profile.d/00-update.sh
sudo systemctl daemon-reload