Gitlab is infected with trojans on the Internet

Phenomenon, internet packet sending, traffic surge

Is gitlab secure?

[20:20:49] Warning: Network TCP port 6667 is being used by/var/tmp/lib/init. Possible Rootkit: Possible rogue IRC Bot
Use the 'lsof-I 'or 'netstat-any' command to check this.

[[Email protected] ~] # Ls-Al/var/tmp/lib/init
-Rwxrwxr-x 1 git 190910 Jul 3/var/tmp/lib/init

Solution: first shut down the Internet, view the process, and find two suspicious processes. Download rkhunter and scan to find the trojan location and find the process started by the Trojan.

RegEx. Done