Spent 2 hours googling.

aspaszoog

Realised that the virus instead of /usr/local/bin installed itself into /usr/bin where user malware does not have the write permissions.