How to kill botnets

Recently, several servers were found to have zombie processes ().

 

Run the following command to find the zombie process:

PS-a-o stat, ppid, PID, CMD | grep-e '^ [zz]'

Command annotation:
-Parameter A lists all processes.
-O custom output field we set the display field to stat (Status), ppid (process parent ID), PID (process ID), CMD (command) these four parameters

 
-C is used to specify the name of the command to be executed. Here you let PS only display the process information generated by the php Command.
 

PS-C Java-O lstart, PID, CMD [but it seems that the print is incomplete ~]
 

 
PS-a-o lstart, PID, argS | grep Java [This can ~]
 

Because the process in the Z or Z status is a zombie process, we use grep to capture the stat status as ZZ process.
The running result is as follows:

There are a total of nine zombie processes. We need to take them all out and execute the following command

Kill-9 8310

Then you run the search for dead processes and find that all dead processes are gone.

Supplement:

Recently I encountered another problem. A server generates 100 dead processes, and the parent processes of each dead process are different, that's not exhausting me.
You should think of a simple command to directly search for dead processes and then kill the parent process ~

PS-a-o stat, ppid, PID, CMD | grep-e '^ [zz]' | awk '{print $2}' | xargs kill-9