linux系统挖矿病毒一键清理

#!/bin/bash
echo "1. 查杀守护进程kinsing"
pkill -9 -f kinsing kdevtmpfsi xmrig miner
echo "2. 解锁锁定病毒文件"
find /tmp /var/tmp /dev/shm -exec chattr -i {} \;
echo "3. 删除全部挖矿程序"
rm -rf /tmp/* /var/tmp/* /dev/shm/*
find / -name "*miner*" -o -name "*xmrig*" -delete 2>/dev/null
echo "4. 清空所有定时任务"
crontab -r;for u in $(cut -d: -f1 /etc/passwd);do crontab -r -u $u 2>/dev/null;done
sed -i '/curl\|wget\|http/d' /etc/crontab;rm -rf /var/spool/cron/*
echo "5. 删除恶意系统服务"
systemctl stop kdevtmpfsi sys-update 2>/dev/null
systemctl disable kdevtmpfsi sys-update 2>/dev/null
rm -f /etc/systemd/system/*kdevtmpfsi*.service
systemctl daemon-reload
echo "6. 清理登录自启后门"
sed -i '/curl\|wget\|miner/d' /root/.bashrc /etc/profile
echo "7. 清除动态库劫持"
> /etc/ld.so.preload
echo "清理完成，重启服务器释放D状态顽固进程"
reboot