Linux Server virus Cleanup practice

Background: The client server is mounted with a Trojan horse for mining (bitcoin).

This cleanup is done through the Linux Basic command. The principle is also relatively simple, through the PS command to view the server exception process, and then through the lsof command to locate the files accessed by the process, find the exception file deletion, and finally to ensure foolproof, can be found by the Find command in the recent time the server generated by the file further exclusions.

Beginning with the top command to discover that a process occupies a large amount of system CPU resources, the process is not our system business process. The process is killed by Kill-9 PID, and after a while, the progress is resumed. Suspect is a timed task pull up, fixed the next scheduled task related configuration file/etc/crontab file, sure enough, there is a new added content in the file, kill the configuration, and find its startup executable file, delete it. Continue to kill the process, but found that the process was pulled up again. It appears that there are more than one scheduled task and there may be other daemons.

Use the PS command to view all recently started processes: Ps-aux--sort=start_time |tail-n 50

Through analysis, there are several processes that have problems with startup scripts that have the wget process of downloading files from the network.

The Lsof-p PID locates the related file resource accessed by the above exception process, and deletes the non-system files after the kill corresponding process.

After observing a period of time, we find that the abnormal process is up. This is the beginning of a headache, where else. Could it be that some system files were infected? Follow this line of thought and find a list of files that have been modified in recent times

Find $path-ctime-30 Print

/usr/root/tmp/bin and other system directory to find a lot of abnormal files, and even some of the common commands such as: PS netstat lsof wget, etc. have been tampered with (through the Stat command to view the status).

and the above system command size is exactly the same, forget the next MD5 is also the same, sure enough there is a problem. Copy the corresponding command file and put it in the online virus database comparison, it is a virus. Replace the infected system command with the corresponding file of the normal server first. Then follow the previous cleanup steps and clean up again. Well, observed for a while, no process files were pulled up again.

Next, trace the recent changes to the file to see if you can find out how the hacker hacked in. We found that in the ACTIVEMQ directory there are a large number of exception JSP files, to view its contents, is simply a web version of the command execution tool AH. It seems that the activemq of our server has a loophole, was exploited by hackers, implanted backdoor files, and then use the wget command to download the virus to complete the virus implantation, and then use the command execution tool to complete the relevant process deployment. For the temporary workaround, we chose to block access to the admin page of the ACTIVEMQ (the port was previously opened to the public network). This is the end of the virus cleanup.

Reflection: The use of some open source components on the server, we should remain vigilant, can not be said completely not, but to keep an eye on the vulnerability of the component, timely repair, at the same time, for some non-public resources access, avoid open to public network. Develop regular security checks on the system.

Linux Server virus Cleanup practice