简单处理一下挖矿进程

接收服务器异常报警短信,进入服务器查看进程,显示cpu高占率的进程,

$ top -c
PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND                                                                                                                                
2192163 test        20   0 2989000   2.3g   8084 S 200.3  14.7   1226:48 [kworker/u2:i2]

查看进程运行源文件位置

$ ll /proc/2192163
...略
lrwxrwxrwx   1 mm   mm   0 Nov 11 13:02 cwd -> /home/test/.cache/.local/.local/
-r--------   1 mm   mm   0 Nov 11 12:34 environ
lrwxrwxrwx   1 mm   mm   0 Nov 11 12:34 exe -> /home/test/.cache/.local/.local/stak/ld-linux-x86-64.so.2*
...略

$ tar -czvf local.tar.gz .local # 出于习惯,对文件做的了备份 -_-!!! 
.local/
.local/upd
.local/run
.local/bash
.local/stak3/
.local/stak3/libdl.so.2
.local/stak3/librt.so.1
.local/stak3/libidn.so.11
.local/stak3/xmrig
.local/stak3/libffi.so.6
.local/stak3/libmicrohttpd.so.10
.local/stak3/libgpg-error.so.0
.local/stak3/ld-linux.so.2
.local/stak3/libgmp.so.10
.local/stak3/libm.so.6
.local/stak3/libgnutls.so.30
.local/stak3/libz.so.1
.local/stak3/libc.so.6
.local/stak3/libhogweed.so.4
.local/stak3/libcrypto.so.1.0.0
.local/stak3/libp11-kit.so.0
.local/stak3/libtasn1.so.6
.local/stak3/libnettle.so.6
.local/stak3/libpthread.so.0
.local/stak3/libssl.so.1.0.0
.local/stak3/libgcrypt.so.20
.local/z
.local/dir.dir
.local/x
.local/stak/
.local/stak/libkrb5support.so.0
.local/stak/libdl.so.2
.local/stak/librt.so.1
.local/stak/xmrig
.local/stak/libcom_err.so.2
.local/stak/libgcc_s.so.1
.local/stak/libnuma.so.1
.local/stak/libgssapi_krb5.so.2
.local/stak/libm.so.6
.local/stak/libpcre.so.1
.local/stak/libresolv.so.2
.local/stak/libz.so.1
.local/stak/libssl.so.10
.local/stak/libc.so.6
.local/stak/libhwloc.so.5
.local/stak/libk5crypto.so.3
.local/stak/ld-linux-x86-64.so.2
.local/stak/libkeyutils.so.1
.local/stak/libkrb5.so.3
.local/stak/libpthread.so.0
.local/stak/libltdl.so.7
.local/stak/libcrypto.so.10
.local/stak/libselinux.so.1
.local/a
.local/h64
.local/bash3
.local/.a
.local/c
.local/bash.pid
.local/cron.d
.local/h32

1. 首次尝试
   进行尝试修改cron.d文件位置,再kill -9 2192163, 无效,过了一会又自动重启
   定时任务已经被启动过,此时修改cron.d没去重启crontab的话.应该是无法重启定时任务的

2. 直接删除启动文件
   删除之后,再kill进程,删除定时任务,再观察定时任务日志,

root@主机名:/home/test/.cache# rm -rf .local
root@主机名:/home/test/.cache# kill -9 218786
# 切换到进程对应的用户 su test
# 查看定时任务
test@主机名:/root$ crontab -l
* * * * * /home/test/.cache/.local/.local/upd >/dev/null 2>&1
# 删除定时任务,再查看定时任务
test@主机名:/root$ crontab -l
#* * * * * /home/test/.cache/.local/.local/upd >/dev/null 2>&1

查看定时间任务日志

root@iZbp18fygyh37en455ppjvZ:/var/log# tail -f syslog
Nov 11 13:18:01 主机名 CRON[2617883]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:19:01 主机名 CRON[2618583]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:20:01 主机名 CRON[2619276]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:21:01 主机名 CRON[2619957]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:21:58 主机名 systemd[1]: Started Session 378189 of user root.
Nov 11 13:22:01 主机名 CRON[2620676]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:23:01 主机名 CRON[2621362]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:24:01 主机名 CRON[2622041]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:25:01 主机名 CRON[2622730]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Nov 11 13:25:01 主机名 CRON[2622731]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:26:01 主机名 CRON[2623441]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:26:11 主机名 crontab[2623556]: (root) LIST (root)
Nov 11 13:26:27 主机名 crontab[2623739]: (test) LIST (test)
Nov 11 13:26:33 主机名 crontab[2623810]: (test) BEGIN EDIT (test)
Nov 11 13:27:01 主机名 CRON[2624162]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:27:05 主机名 crontab[2623810]: (test) REPLACE (test)
Nov 11 13:27:05 主机名 crontab[2623810]: (test) END EDIT (test)
Nov 11 13:27:11 主机名 crontab[2624271]: (test) LIST (test)
Nov 11 13:28:01 主机名 cron[558]: (test) RELOAD (crontabs/test)
Nov 11 13:35:01 主机名 CRON[2629610]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Nov 11 13:45:01 主机名 CRON[2636413]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)

最终定时任务日志正常的…也没有异常进程出现…
原因是服务器的账户密码太很简单,
修改为16位复杂密码,
结束