一.背景
最近公司一台虛擬機被攻擊，其中一種挖礦病毒、會偽CPU數、即如果用top命令只能看到一個cpu、並且負載不高、實際上整個負載300%以上,及時定時任務關掉也不起作用。
二.言歸正傳開始干掉這個麻煩的病毒（腳本如下）:
-
#關掉定時任務
-
service crond stop
-
#刪除so庫
-
busybox rm -f /etc/ld.so.preload
-
busybox rm -f /usr/local/lib/libcset.so
-
chattr -i /etc/ld.so.preload
-
busybox rm -f /etc/ld.so.preload
-
busybox rm -f /usr/local/lib/libcset.so
-
# 清理異常進程
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'ksoftirqds' | busybox awk '{print $1}' | busybox xargs kill -9
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'kthrotlds' | busybox awk '{print $1}' | busybox xargs kill -9
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'kpsmouseds' | busybox awk '{print $1}' | busybox xargs kill -9
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'kintegrityds' | busybox awk '{print $1}' | busybox xargs kill -9
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'khugepageds' | busybox awk '{print $1}' | busybox xargs kill -9
-
busybox rm -f /tmp/kthrotlds
-
busybox rm -f /tmp/kintegrityds
-
busybox rm -f /tmp/khugepageds
-
busybox rm -f /tmp/kpsmouseds
-
busybox rm -f /etc/cron.d/tomcat
-
busybox rm -f /etc/cron.d/root
-
busybox rm -f /var/spool/cron/root
-
busybox rm -f /var/spool/cron/crontabs/root
-
busybox rm -f /etc/rc.d/init.d/kthrotlds
-
busybox rm -f /etc/rc.d/init.d/kpsmouseds
-
busybox rm -f /etc/rc.d/init.d/kintegrityds
-
busybox rm -f /usr/sbin/kthrotlds
-
busybox rm -f /usr/sbin/kintegrityds
-
busybox rm -f /usr/sbin/kpsmouseds
-
busybox rm -f /etc/init.d/netdns
-
busybox rm -f /tmp/ld.so.preload*
-
ldconfig
-
# 再次清理異常進程
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'ksoftirqds' | busybox awk '{print $1}' | busybox xargs kill -9
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'kthrotlds' | busybox awk '{print $1}' | busybox xargs kill -9
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'kpsmouseds' | busybox awk '{print $1}' | busybox xargs kill -9
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'kintegrityds' | busybox awk '{print $1}' | busybox xargs kill -9
-
busybox ps -ef | busybox grep -v grep | busybox egrep 'khugepageds' | busybox awk '{print $1}' | busybox xargs kill -9
# 清理開機啟動項
chkconfig netdns off
chkconfig –del netdns
service crond start
echo "Done, Please reboot!"
補充：由於近期很多人咨詢有wiki，redis,jenkins中招的情況，建議盡快備份數據，重裝系統，默認端口修改復雜端口，服務僅供內部使用。