Comment
Author: Admin | 2025-04-28
Foreword The holiday remote office, so the server IP is mapped to the public network. It is not necessary to be implanted with mineral horse viruses, and record this discovery and solvement experience. How to confirm that digging mine horses? First introduce it, the server has installed the CentOS system, and suddenly found today.cd Use when commandTab The key actually reported this error: cannot create temp file for here-document: No space left on device Then use the commanddf -h Check the hard disk space and find that the root directory is full, then (under root privilege)ls -A Command, I found that all is similar toethminer.tar The file is probably this: I checked Ethminer, the mining program is undoubtedly. use rm -rf ethminer* After trying to delete these files, I found out again. . So guess the timing of time scripting tasks, usecrontab -l View timetry, return: @daily /var/tmp/.tmp/./.b4nd1d0 @reboot /var/tmp/.tmp/./.placi > /dev/null 2>&1 & disown * * * * * /var/tmp/.tmp/./.placi > /dev/null 2>&1 & disown @monthly /var/tmp/.tmp/./.placi > /dev/null 2>&1 & disown It's not a good thing at first glance. Use Vim to view it, the diagnosis server is implanted into the Ethminer digging mine hum! Handle First, delete the Trojan script and the downloaded messy things, found more than/var/tmpThere are related Trojans under the path./ 、 /root Waiting for the catalog. rm -rf /var/tmp/.tmp/./.b4nd1d0rm -rf /var/tmp/.tmp/./.placirm -rf /var/tmp/.tmp/./binrm -rf /var/tmp/.ladyg0g0rm -rf /usr/bin/.locationesclipiciurm -rf /usr/bin/.pidscliprm -rf /.b4nd1d0rm -rf /root/.b4nd1d0rm -rf /root/binrm -rf /usr/.SQL-Unixrm -rf /usr/tmprm -rf /usr/bin/sshd# Miner.tar. * File not necessarily in which directoryrm -rf /root/ethminer*rm -rf /var/tmp/.tmp/./ethminer*# Delete Sclipicibosu usersuserdel -r sclipicibosu# Remove Using Chmod to modify / etc / passwd and / etc / etc / passwd and / etc / shadow permissions, use VIM to delete / etc / passwd and / etc / shadow.rm
Add Comment