ULTRA SKYRAGE MALWARE REMOVER Edited by ziue, originally from iVirus 1.0.0

SKYRAGE MALWARE REMOVER | Edited by ziue, originally from iVirus_

This is not a plugin!



A new malware has been discovered, it infects other jars inside server folder (plugins, server jar...). The malware creates a service "vmd-gnu" to maintein a persistent access.

If you find: java.net.NoRouteToHostException: No route to host in your server logs probably you are infected.

You can use this command (from linux) to check if you are infected: grep -R "plugin-config.bin" .

I developed a tool to check all your jars inside server folder and clean them.
Download it from the message below this.

How to use:
1. Stop your server
2. Put tool where you want (I recommend server folder)
3. Start it with: "java -jar SkyrageRemover.jar"
4. Press Y to clean your system
5. Press Y to clean your jars
6. Press Y to replace jars (If you type N the infected plugins will be renamed in PluginName-infected and the new clean plugins in PluginName-clean)

Malware details: https://forums.papermc.io/threads/malware-announcement.529/