Linux服务器中木马wnTKYg

标签：文件   var   cpu   修改密码   lib   span   roo   png   crontab   

1、修改服务器密码

Top命令查看，发现cpu过高

[root@localhost ~]# top

修改密码

[root@localhost ~]# passwd root

2、停用进程

[root@localhost ~]#Kill -9 1174

3、删除tmp中文件

[root@localhost ~]# cd /tmp/

[root@localhost ~]# rm -rf *ddg*

4、删除定时任务

[root@localhost ~]# crontab -e

ps -ef|grep -v grep|grep "imWBR1"|awk ‘{print $2}‘|xargs kill -9

ps -ef|grep -v grep|grep "ddgs"|awk ‘{print $2}‘|xargs kill -9

ps -ef|grep -v grep|grep "wnTKYg"|awk ‘{print $2}‘|xargs kill -9

echo ‘‘ > /var/spool/cron/root

echo ‘‘ > /var/spool/cron/crontabs/root

rm -rf /var/spool/cron/*

rm -rf /tmp/*

mv /usr/bin/curl /usr/bin/curl.bak

mv /usr/bin/wget /usr/bin/wget.bak

Linux服务器中木马wnTKYg

标签：文件   var   cpu   修改密码   lib   span   roo   png   crontab   

原文地址：https://www.cnblogs.com/bingmengzhang/p/10069445.html