1、问题排查显示

1.1服务器中情况

 
xmrig挖矿病毒解决
 

1.2后台查看情况

 
xmrig挖矿病毒解决
 
xmrig挖矿病毒解决
 
 
 

2、查看进程

 
[[email protected] cron]# ll /proc/8236/exe
lrwxrwxrwx 1 root root 0 Nov 20 10:52 /proc/8236/exe -> /etc/c3pool/xmrig
 

3、查看进程文件

[[email protected] cron]# ll /proc/8236/exe
lrwxrwxrwx 1 root root 0 Nov 20 10:52 /proc/8236/exe -> /etc/c3pool/xmrig
[[email protected] cron]# cd /etc/c3pool
[[email protected] c3pool]# ll
total 2256
-rw-r--r-- 1 root root    2389 Nov 17 09:44 config_background.json
-rw-r--r-- 1 root root    3660 Nov 17 09:50 config.json
-rwxr-xr-x 1 root root     470 Nov 17 09:44 miner.sh.back
-rwxr-xr-x 1 root root 2297376 Nov 16 01:44 xmrig
[[email protected] c3pool]# pwd
/etc/c3pool
[[email protected] c3pool]#
 

4、杀死进程

 
 sudo kill -9 8236
在查看就没有了
 

5、 查看定时任务 

crontab -l
[[email protected] c3pool]# crontab -l
30 21 * * * bash /etc/c3pool/miner.sh
 
 

6、vim /etc/crontab

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
 
# For details see man 4 crontabs
 
# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name  command to be executed
 
 

7、全局搜索crond配置文件

[[email protected] cron]# find / -name cron* -type d
/usr/share/doc/cronie-1.4.11
/var/spool/cron
/etc/cron.d
/etc/cron.hourly
/etc/cron.daily
/etc/selinux/targeted/active/modules/100/cron
/etc/cron.weekly
/etc/cron.monthly
/sys/fs/cgroup/devices/system.slice/crond.service
/sys/fs/cgroup/systemd/system.slice/crond.service
[[email protected] cron]# cd /var/spool/cron/
[[email protected] cron]# ll
total 4
-rw------- 1 root root 38 Nov 17 09:45 root
[[email protected] cron]# cat root
30 21 * * * bash /etc/c3pool/miner.sh
 

8、删除 /var/spool/cron 中的数据

 

9、重启crond服务:service crond restart

 

 

相关文章: