Remember the post-horse processing in Linux systems (RHEL6.3, Trojan Horse: linux.backdoor.gates.5)

Medium Horse Symptoms: The machine desperately outward contracted, exhausted network traffic.

650) this.width=650; "title=" 1.jpg "alt=" wkiol1r-0cqwycvwaaeu7uowv64372.jpg "src=" http://s3.51cto.com/wyfs02/M01/ 54/4f/wkiol1r-0cqwycvwaaeu7uowv64372.jpg "/>

So check the network connection using Netstat-antuple (here the first step is wrong, because the Trojan has replaced some system commands, including netstat, please forgive my ignorance)

650) this.width=650; "title=" 2.jpg "alt=" wkiol1r-0gkrt5wgaabjgt-jlr8188.jpg "src=" http://s3.51cto.com/wyfs02/M01/ 54/4f/wkiol1r-0gkrt5wgaabjgt-jlr8188.jpg "/>

There's a 222 . the IP from Jiangsu has already established a connection

This can be a temporary emergency, with iptables will be sent from and to the IP packet dropped,

Iptables-i input-s 222.186.30.203-j DROP

Iptables-i output-d 222.186.30.203-j DROP

Then service iptables Save

Then review the process,PS aux

650) this.width=650; "title=" 3.jpg "alt=" wkiom1r-0absrn3vaabnsywmiji948.jpg "src=" http://s3.51cto.com/wyfs02/M01/ 54/50/wkiom1r-0absrn3vaabnsywmiji948.jpg "/>

Kill it decisively! With the kill-9 process number, and then rm-rf Delete the file, kill the process with the PS command to see again, the process restarted, and Trojan files are also regenerated.

At this time decisively to I know the big God Yuan always ask for advice, Yuan always said with Chkrookit or rkhunter to see if is replaced the system command, so decisive with Chkrookit . sure enough, the hint has been in the Trojan.

650) this.width=650; "title=" 4.jpg "alt=" wkiol1r-0pgjjo0kaabggjurrjw710.jpg "src=" http://s3.51cto.com/wyfs02/M00/ 54/4f/wkiol1r-0pgjjo0kaabggjurrjw710.jpg "/>

It is strange to see the PS command creation date again, and it is the same size as the netstat ...

650) this.width=650; "title=" 5.jpg "alt=" wkiom1r-0h6chnpoaabdwhg6ubw151.jpg "src=" http://s3.51cto.com/wyfs02/M00/ 54/50/wkiom1r-0h6chnpoaabdwhg6ubw151.jpg "/>

Sure enough, the system command was replaced!

Find the PS and netstatwith the Find command and find the original system command file that was replaced in the /usr/bin/dpkgd directory

650) this.width=650; "title=" 6.jpg "alt=" wkiol1r-0s_a9iomaac67iullf0571.jpg "src=" http://s3.51cto.com/wyfs02/M02/ 54/4f/wkiol1r-0s_a9iomaac67iullf0571.jpg "/>

Look at the next time , one month , 3 points in the morning to create, sure enough is black. 650) this.width=650; "title=" 7.jpg "alt=" wkiom1r-0lcbptshaaao61kfbgi635.jpg "src=" http://s3.51cto.com/wyfs02/M02/ 54/50/wkiom1r-0lcbptshaaao61kfbgi635.jpg "/>

At this point I notice that the size of these Trojan files are 1135000 bytes, and then use the following command from the root to find the size of 1135000 bytes Trojan Backdoor program

# Find/-size 1135000c

650) this.width=650; "title=" 8.png "alt=" wkiol1r-0ufzyjyvaacre-ndpwo814.jpg "src=" http://s3.51cto.com/wyfs02/M00/ 54/4f/wkiol1r-0ufzyjyvaacre-ndpwo814.jpg "/>

Found 7 , and chkrookit hint, the same, according to the file name search process,kill All delete, put /usr/bin/dpkgd The original system command file is moved back to the original directory.

At this time again with the original system PS and netstat command has not seen the Trojan process and suspicious network connection.

Is this the end of it? No, I went on the internet to search the information of this trojan, to find out.

Trojan for: Linux.backdoor.gates.5

Symptoms: Outward madness, resulting in network paralysis, camouflage system services.

http://blog.csdn.net/liukeforever/article/details/38560363

Http://bbs.appstar.com.cn/thread-10205-1-1.html

DBSECURITYSPT and

Sure enough, the Trojan is still in the/etc/under the rc1.d,rc2.d,rc3.d,rc4.d, RM-RF rc5.d set up a link to selinux,dbsecurityspt under the init.d directory .

Open selinux,dbsecurityspt is run Trojan file!

650) this.width=650; "title=" 9.png "style=" Float:none; "alt=" wkiom1r-0wlrmkiraaa2kgvvsiq169.jpg "src=" http:/ S3.51cto.com/wyfs02/m02/54/51/wkiom1r-0wlrmkiraaa2kgvvsiq169.jpg "/>

650) this.width=650; "title=" 10.png "style=" Float:none; "alt=" wkiol1r-046rmln2aabk9d3rge0848.jpg "src=" http:/ S3.51cto.com/wyfs02/m00/54/4f/wkiol1r-046rmln2aabk9d3rge0848.jpg "/>

Well, it's almost there.

Summarize:

1. If the system can be re-installed directly

2 、......

Remember the post-horse processing in Linux systems (RHEL6.3, Trojan Horse: linux.backdoor.gates.5)