Linux 服务器感染kerberods 病毒_busybox chattr -ia

11 busybox echo “” > /root/.ssh/authorized_keys
12 busybox echo “” > /root/.ssh/id_rsa
13 busybox echo “” > /root/.ssh/id_rsa.pub
14 busybox echo “” > /root/.ssh/known_hosts
15 #busybox echo “” > /root/.ssh/auth
16 #iptables -I INPUT -p tcp --dport 445 -j DROP
17 busybox echo -e “\n0.0.0.0 pastebin.com\n0.0.0.0 thyrsi.com\n0.0.0.0 systemten.org” >> /etc/hosts
18 }
19
20
21 function fixCron(){
22 #修复crontab
23 busybox chattr -i /etc/cron.d/root 2>/dev/null
24 busybox rm -f /etc/cron.d/root
25 busybox chattr -i /var/spool/cron/root 2>/dev/null
26 busybox rm -f /var/spool/cron/root
27 busybox chattr -i /var/spool/cron/tomcat 2>/dev/null
28 busybox rm -f /var/spool/cron/tomcat
29 busybox chattr -i /var/spool/cron/crontabs/root 2>/dev/null
30 busybox rm -f /var/spool/cron/crontabs/root
31 busybox rm -rf /var/spool/cron/tmp.*
32 busybox rm -rf /var/spool/cron/crontabs
33 busybox touch /var/spool/cron/root
34 busybox chattr +i /var/spool/cron/root
35 }
36
37 function killProcess(){
38 #修复异常进程
39 #busybox ps -ef | busybox grep -v grep | busybox grep ‘khugepageds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
40 #busybox ps -ef | busybox grep -v grep | busybox egrep ‘ksoftirqds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
41 #busybox ps -ef | busybox grep -v grep | busybox egrep ‘kthrotlds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
42 #busybox ps -ef | busybox grep -v grep | busybox egrep ‘kpsmouseds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
43 #busybox ps -ef | busybox grep -v grep | busybox egrep ‘kintegrityds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
44 busybox ps -ef | busybox grep -v grep | busybox grep ‘/usr/sbin/kerberods’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
45 busybox ps -ef | busybox grep -v grep | busybox grep ‘/usr/sbin/sshd’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
46 busybox ps -ef | busybox grep -v grep | busybox egrep ‘/tmp/kauditds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
47 busybox ps -ef | busybox grep -v grep | busybox egrep ‘/tmp/sshd’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
48 busybox rm -f /tmp/khugepageds
49 busybox rm -f /tmp/migrationds
50 busybox rm -f /tmp/sshd
51 busybox rm -f /tmp/kauditds
52 busybox rm -f /tmp/migrationds
53 busybox rm -f /usr/sbin/sshd
54 busybox rm -f /usr/sbin/kerberods
55 busybox rm -f /usr/sbin/kthrotlds
56 busybox rm -f /usr/sbin/kintegrityds
57 busybox rm -f /usr/sbin/kpsmouseds
58 b