linux 进程s01wipefs,/bin/wipefs挖矿程序排查

#基本情况

[root@test ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@test ~]# uname -a

Linux test 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

[root@test ~]# file /bin/wipefs

/bin/wipefs: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped

[root@test ~]# ll /bin/wipefs

-rwxr-xr-x 1 root root 2384177 Jul 18 2013 /bin/wipefs

[root@monitor ~]# lsattr /bin/wipefs

----i--------e- /bin/wipefs

[root@monitor ~]# lsattr /bin/ddus-uidgen

----i--------e- /bin/ddus-uidgen

#改动了dns配置

[root@test rc3.d]# stat /etc/resolv.conf

File: `/etc/resolv.conf'

Size: 106 Blocks: 8 IO Block: 4096 regular file

Device: 802h/2050d Inode: 1182160 Links: 1

Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)

Access: 2017-11-22 06:00:02.797144215 +0800

Modify: 2017-11-22 06:00:02.795144215 +0800

Change: 2017-11-22 06:00:02.795144215 +0800

[root@test rc3.d]# cat /etc/resolv.conf

nameserver 208.67.222.222#加拿大DNS

nameserver 114.114.114.114

nameserver 208.67.222.222

nameserver 114.114.114.114

#增加了开机启动

[root@test cron]# ll /etc/init.d/wipefs

lrwxrwxrwx 1 root root 11 Nov 22 06:00 /etc/init.d/wipefs -> /bin/wipefs

[root@test rc3.d]# pwd

/etc/rc.d/rc3.d

[root@test rc3.d]# ll -h |grep wipefs

lrwxrwxrwx 1 root root 18 Nov 22 06:00 S01wipefs -> /etc/init.d/wipefs

[root@test rc3.d]# cd /etc/rc3.d/

[root@test rc3.d]# ll -h |grep wipefs

lrwxrwxrwx 1 root root 18 Nov 22 06:00 S01wipefs -> /etc/init.d/wipefs

[root@test init.d]# pwd

/etc/init.d

[root@test init.d]# ll acpidtd

-rwxr-xr-x 1 root root 1223753 Nov 20 16:03 acpidtd

[root@test rc3.d]# ll -h |grep acpidtd

lrwxrwxrwx 1 root root 19 Nov 20 16:03 S01acpidtd -> /etc/init.d/acpidtd

[root@test rc3.d]# pwd

/etc/rc3.d

[root@test rc3.d]# cd /etc/rc.d/rc3.d/

[root@test rc3.d]# ll -h |grep acpidtd

lrwxrwxrwx 1 root root 19 Nov 20 16:03 S01acpidtd -> /etc/init.d/acpidtd

[root@test rc3.d]# ll /bin/ddus-uidgen

-rwxr-xr-x 1 root root 1223753 Nov 20 16:03 /bin/ddus-uidgen

[root@test rc3.d]# ll /etc/resolv.conf

-rw-r--r-- 1 root root 106 Nov 22 06:00 /etc/resolv.conf

#清理

pkill wipefs

echo "nameserver 114.114.114.114" > /etc/resolv.conf

chattr -i /bin/wipefs

chattr -i /bin/ddus-uidgen

chattr -i /etc/init.d/acpidtd

rm -rf /bin/wipefs

rm -rf /etc/init.d/wipefs

rm -rf /bin/ddus-uidgen

rm -rf /etc/init.d/acpidtd

rm -rf /etc/rc0.d/S01wipefs

rm -rf /etc/rc1.d/S01wipefs

rm -rf /etc/rc2.d/S01wipefs

rm -rf /etc/rc3.d/S01wipefs

rm -rf /etc/rc4.d/S01wipefs

rm -rf /etc/rc5.d/S01wipefs

rm -rf /etc/rc6.d/S01wipefs

rm -rf /etc/rc.d/rc0.d/S01wipefs

rm -rf /etc/rc.d/rc1.d/S01wipefs

rm -rf /etc/rc.d/rc2.d/S01wipefs

rm -rf /etc/rc.d/rc3.d/S01wipefs

rm -rf /etc/rc.d/rc4.d/S01wipefs

rm -rf /etc/rc.d/rc5.d/S01wipefs

rm -rf /etc/rc.d/rc6.d/S01wipefs

rm -rf /etc/rc0.d/acpidtd

rm -rf /etc/rc1.d/acpidtd

rm -rf /etc/rc2.d/acpidtd

rm -rf /etc/rc3.d/acpidtd

rm -rf /etc/rc4.d/acpidtd

rm -rf /etc/rc5.d/acpidtd

rm -rf /etc/rc6.d/acpidtd

rm -rf /etc/rc.d/rc0.d/acpidtd

rm -rf /etc/rc.d/rc1.d/acpidtd

rm -rf /etc/rc.d/rc2.d/acpidtd

rm -rf /etc/rc.d/rc3.d/acpidtd

rm -rf /etc/rc.d/rc4.d/acpidtd

rm -rf /etc/rc.d/rc5.d/acpidtd

rm -rf /etc/rc.d/rc6.d/acpidtd