Linux服务器中木马wnTKYg

Posted 2021-01-24 冰梦

1、修改服务器密码

Top命令查看，发现cpu过高

[root@localhost ~]# top

 

修改密码

[root@localhost ~]# passwd root

2、停用进程

[root@localhost ~]#Kill -9 1174

3、删除tmp中文件

[root@localhost ~]# cd /tmp/

[root@localhost ~]# rm -rf *ddg*

4、删除定时任务

[root@localhost ~]# crontab -e

 

 

ps -ef|grep -v grep|grep "imWBR1"|awk \'{print $2}\'|xargs kill -9

ps -ef|grep -v grep|grep "ddgs"|awk \'{print $2}\'|xargs kill -9

ps -ef|grep -v grep|grep "wnTKYg"|awk \'{print $2}\'|xargs kill -9

echo \'\' > /var/spool/cron/root

echo \'\' > /var/spool/cron/crontabs/root

rm -rf /var/spool/cron/*

rm -rf /tmp/*

mv /usr/bin/curl /usr/bin/curl.bak

mv /usr/bin/wget /usr/bin/wget.bak