81
centos6中了挖矿木马的解决办法-赛里
source link: http://blog.51cto.com/net881004/2083933
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
有一个客户服务器root密码设置很简单，被入侵挂马了。top能看到名称大概为10个字母的进程，字母是随机的。一看就不是正常进程（而且杀掉问题进程会自动生成新的、删除问题服务也会自动生成、很占用服务器带宽总是连接外网一个主机）。这种情况下，一般建议断开外网，然后处理。问题现象：1、查看定时任务（注意这三个地方都看下）[root@localhost ~]# crontab 
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK