How to kill botnets in Linux

Article Title: How to kill botnets in Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

1) Check the current zombie Process Information

# Ps-ef | grep defunct | grep-v grep | wc-l

175

# Top | head-2

Top-15:05:54 up 97 days, 4 users, load average: 0.66, 0.45, 0.39

Tasks: 829 total, 1 running, 479 sleeping, 174 stopped, 175 zombie

# Ps-ef | grep defunct | grep-v grep

2) obtain the bot killing process statement

# Ps-ef | grep defunct | grep-v grep | awk '{print "kill-9" $2, $3 }'

Execute the statement obtained above. With semaphore 9, the number of zombie processes will be greatly reduced.

3) Check the current zombie process information later.

# Ps-ef | grep defunct | grep-v grep | wc-l

125

# Top | head-2

Top-15:29:26 up 98 days, 12 min, 7 users, load average: 0.27, 0.54, 0.56

Tasks: 632 total, 1 running, 381 sleeping, 125 stopped, 125 zombie

It is found that the number of zombie processes has been reduced, but there are still many.

4) obtain the zombie killing statement again.

# Ps-ef | grep defunct | grep-v grep | awk '{print "kill-18" $3 }'

Execute the statement obtained above. This time, use semaphores 18 to kill the parent process, and all zombie processes will disappear.

5) Check the current zombie process information later.

# Ps-ef | grep defunct | grep-v grep | wc-l

0

# Top | head-2

Top-15:39:46 up 98 days, 23 min, 7 users, load average: 5.46, 2.20, 1.12

Task: 134 total, 1 running, 133 sleeping, 0 stopped, 0 zombie

6) purge ZOMBIE (ZOMBIE) process principles

# Kill-18 PPID

PPID is the parent process. This signal tells the parent process that the child process has died. Please reclaim the resources allocated to it. if not, check whether the parent process has any other sub-processes. If yes, kill other sub-processes first, that is, the sibling process.

The method is:

# Kill-15 PID1 PID2

PID1 and PID2 are other sub-processes of the parent process of the zombie process.

Then kill the parent process:

# Kill-15 PPID

-- End --