Shulou(Shulou.com)06/02 Report--

Preface

Because the CPU of the server is as high as 96% inadvertently, the access is very slow; when troubleshooting the problem, it was found that the server was attached to the mining program.

1. List of names of mining procedures:

Networkservice

Sysguard

Update.sh

Config.json

Sysupdates

Kow930kd

Kow709kd

2. List of log names of mining procedures

101_og

275_og

2_og

630og

Sess*

3. Treatment method

1) use the top method to find the PID numbers of all suspicious file processes

2) # kill-9$ PID

3) locate the directory where the files are located and delete all executable files # ls-l / proc/$PID/exe

4) # rm-rf networkservices [delete separately, delete as many as possible]

5) Delete / root/.ssh/authorized_keys # rm-rf / root/.ssh/authorized_keys

6) Delete / var/spool/cron/daemon # rm-rf / var/spool/cron/daemon

7) if a system command is tampered with, change the command back to its original state

# mv / bin/wge / bin/wget

# mv / bin/cur / bin/curl

The above command is modified according to the server condition.

8) View iptables Firewall

The order to modify the mining procedure is as follows

Iptables-F

Iptables-X

Iptables-An OUTPUT-p tcp-- dport 3333-j DROP

Iptables-An OUTPUT-p tcp-- dport 5555-j DROP

Iptables-An OUTPUT-p tcp-- dport 7777-j DROP

Iptables-An OUTPUT-p tcp-- dport 9999-j DROP

Iptables-I INPUT-s 43.245.222.57-j DROP

The above ports are checked in the firewall to see if they exist, and delete the rule chain as appropriate

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.