Linux 病毒kdevtmpfsi被挖矿的解决办法(四) 定时脚本删除挖矿病毒脚本

#!/bin/bash

chattr -ia /root/.ssh/authorized_keys
echo "自己定义rsa" > /root/.ssh/authorized_keys 
chattr +ia /root/.ssh/authorized_keys

chattr -i /tmp/kdevtmpfsi
chattr -i /tmp/redis2
rm -rf /tmp/kdevtmpfsi
rm -rf /tmp/redis2

chattr -i /etc/config.json
chattr -i /etc/networkservice 
chattr -i /etc/sysupdate
chattr -i /etc/update.sh
chattr -i /etc/sysguard

rm -rf /etc/config.json
rm -rf /etc/networkservice 
rm -rf /etc/sysupdate
rm -rf /etc/update.sh
rm -rf /etc/sysguard
pkill -n ps -ef|grep sysupdate|grep -v grep|awk '{print $2}'
pkill -n ps -ef|grep sysguard|grep -v grep|awk '{print $2}'

rm -rf /etc/cron.d/root

 

3个小时删除一次，忽略出现的错误

crontab -e  

0 */3 * * * sh /路径/*.sh /dev/null