xmrig挖矿病毒解决

 

1、问题排查显示

1.1服务器中情况

 

 

1.2后台查看情况

 

 

 

 

 

2、查看进程

 

[root@ecs-44a1 cron]# ll /proc/8236/exe

lrwxrwxrwx 1 root root 0 Nov 20 10:52 /proc/8236/exe -> /etc/c3pool/xmrig

[root@ecs-44a1 cron]#

 

3、查看进程文件

[root@ecs-44a1 cron]# ll /proc/8236/exe

lrwxrwxrwx 1 root root 0 Nov 20 10:52 /proc/8236/exe -> /etc/c3pool/xmrig

[root@ecs-44a1 cron]# cd /etc/c3pool

[root@ecs-44a1 c3pool]# ll

total 2256

-rw-r--r-- 1 root root    2389 Nov 17 09:44 config_background.json

-rw-r--r-- 1 root root    3660 Nov 17 09:50 config.json

-rwxr-xr-x 1 root root     470 Nov 17 09:44 miner.sh.back

-rwxr-xr-x 1 root root 2297376 Nov 16 01:44 xmrig

[root@ecs-44a1 c3pool]# pwd

/etc/c3pool

[root@ecs-44a1 c3pool]#

 

4、杀死进程

 

 sudo kill -9 8236

在查看就没有了

 

5、 查看定时任务 

crontab -l

[root@ecs-44a1 c3pool]# crontab -l

30 21 * * * bash /etc/c3pool/miner.sh

 

 

6、vim /etc/crontab

SHELL=/bin/bash

PATH=/sbin:/bin:/usr/sbin:/usr/bin

MAILTO=root

 

# For details see man 4 crontabs

 

# Example of job definition:

# .---------------- minute (0 - 59)

# |  .------------- hour (0 - 23)

# |  |  .---------- day of month (1 - 31)

# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...

# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat

# |  |  |  |  |

# *  *  *  *  * user-name  command to be executed

 

 

7、全局搜索crond配置文件

[root@ecs-44a1 cron]# find / -name cron* -type d

/usr/share/doc/cronie-1.4.11

/var/spool/cron

/etc/cron.d

/etc/cron.hourly

/etc/cron.daily

/etc/selinux/targeted/active/modules/100/cron

/etc/cron.weekly

/etc/cron.monthly

/sys/fs/cgroup/devices/system.slice/crond.service

/sys/fs/cgroup/systemd/system.slice/crond.service

[root@ecs-44a1 cron]# cd /var/spool/cron/

[root@ecs-44a1 cron]# ll

total 4

-rw------- 1 root root 38 Nov 17 09:45 root

[root@ecs-44a1 cron]# cat root

30 21 * * * bash /etc/c3pool/miner.sh

[root@ecs-44a1 cron]#

 

8、删除 /var/spool/cron 中的数据

 

9、重启crond服务：service crond restart