Minerd Trojan Removal method under Linux top _linux

In recent times, there is always someone to reflect the company's one test server access speed is very slow, half a day can not open. At the beginning, it was thought to be the result of a new deployment of the test program for the two days.

Think about the test and turn it off and there's nothing going on.

Later, think carefully, feel wrong. New test procedures, not very consuming resources ah.

So boarded to look, do not see do not know, a look startled.

Top command A check, found that there is a process called Minerd, incredibly occupy 99% of the CPU. It's not a good thing to see the name. It must have been someone else's Trojan horse.

So, in the usual way, first ps-ef|grep minerd look at the details of the process, found this process, the implementation of the/opt/minerd command. So, delete this command, and kill-9 kill the corresponding process.

According to experience, this thing will not be so easy to be removed, there must be other hands and feet, so began to check the crontab.

Sure enough, the root of the crontab has a very suspicious thing, so delete.

For the sake of precaution, use the top command to continue to observe. The strange phenomenon happened, and Minerd appeared again.

This is a bit strange, so I checked it all over again, including the crontab Linux startup command but never found the Minerd trail.
Thought for half a day, the estimate may be crontab not effective.

So, in order, come again.

Stop cronb Service, delete/opt/minerd file, kill-9 kill process.

Restart the CRONB service

Continue top observation.

This is finally no longer appear minerd things, the system has finally returned to normal.