Linux挖礦病毒 khugepageds詳細解決步驟

一.背景

最近公司一臺虛擬機被攻擊，其中一種挖礦病毒、會僞CPU數、即若是用top命令只能看到一個cpu、而且負載不高、實際上整個負載300%以上,及時定時任務關掉也不起做用。

 

二.言歸正傳開始幹掉這個麻煩的病毒（腳本以下）:

#關掉定時任務

service crond stop

#刪除so庫

busybox rm -f /etc/ld.so.preload

busybox rm -f /usr/local/lib/libcset.so

chattr -i /etc/ld.so.preload

busybox rm -f /etc/ld.so.preload

busybox rm -f /usr/local/lib/libcset.so

# 清理異常進程

busybox ps -ef | busybox grep -v grep | busybox egrep 'ksoftirqds' | busybox awk '{print $1}' | busybox xargs kill -9

busybox ps -ef | busybox grep -v grep | busybox egrep 'kthrotlds' | busybox awk '{print $1}' | busybox xargs kill -9

busybox ps -ef | busybox grep -v grep | busybox egrep 'kpsmouseds' | busybox awk '{print $1}' | busybox xargs kill -9

busybox ps -ef | busybox grep -v grep | busybox egrep 'kintegrityds' | busybox awk '{print $1}' | busybox xargs kill -9

busybox ps -ef | busybox grep -v grep | busybox egrep 'khugepageds' | busybox awk '{print $1}' | busybox xargs kill -9

busybox rm -f /tmp/kthrotlds

busybox rm -f /tmp/kintegrityds

busybox rm -f /tmp/khugepageds

busybox rm -f /tmp/kpsmouseds

busybox rm -f /etc/cron.d/tomcat

busybox rm -f /etc/cron.d/root

busybox rm -f /var/spool/cron/root

busybox rm -f /var/spool/cron/crontabs/root

busybox rm -f /etc/rc.d/init.d/kthrotlds

busybox rm -f /etc/rc.d/init.d/kpsmouseds

busybox rm -f /etc/rc.d/init.d/kintegrityds

busybox rm -f /usr/sbin/kthrotlds

busybox rm -f /usr/sbin/kintegrityds

busybox rm -f /usr/sbin/kpsmouseds

busybox rm -f /etc/init.d/netdns

busybox rm -f /tmp/ld.so.preload*

ldconfig

# 再次清理異常進程

busybox ps -ef | busybox grep -v grep | busybox egrep 'ksoftirqds' | busybox awk '{print $1}' | busybox xargs kill -9

busybox ps -ef | busybox grep -v grep | busybox egrep 'kthrotlds' | busybox awk '{print $1}' | busybox xargs kill -9

busybox ps -ef | busybox grep -v grep | busybox egrep 'kpsmouseds' | busybox awk '{print $1}' | busybox xargs kill -9

busybox ps -ef | busybox grep -v grep | busybox egrep 'kintegrityds' | busybox awk '{print $1}' | busybox xargs kill -9

busybox ps -ef | busybox grep -v grep | busybox egrep 'khugepageds' | busybox awk '{print $1}' | busybox xargs kill -9

# 清理開機啓動項
chkconfig netdns off
chkconfig –del netdns

service crond start
echo "Done, Please reboot!"

 

　　　　　　補充：因爲近期不少人諮詢有wiki，redis,jenkins中招的狀況，建議儘快備份數據，重裝系統，默認端口修改複雜端口，服務僅供內部使用。