阿里云中挖矿病毒

kdevtmpfsi有守护进程,单独kill掉kdevtmpfsi进程会不断恢复占用。守护进程名称为kinsing,需要kill后才能解决问题。

#查询关联的守护进程
[root@iZwz97v9b9ili0mz7rl188Z overlay2]# systemctl status 2854
● session-5649.scope - Session 5649 of user root
Loaded: loaded (/run/systemd/system/session-5649.scope; static; vendor preset: disabled)
Drop-In: /run/systemd/system/session-5649.scope.d
└─50-After-systemd-logindx2eservice.conf, 50-After-systemd-user-sessionsx2eservice.conf, 50-Description.conf, 50-SendSIGHUP.conf, 50-Slice.conf, 50-TasksMax.conf
Active: active (abandoned) since 一 2019-12-23 10:41:33 CST; 2 days ago
CGroup: /user.slice/user-0.slice/session-5649.scope
├─ 2854 /tmp/kdevtmpfsi
└─18534 ./kinsing1oZIY4Aid7

 最先要把关联的./kinsing 这个进程给杀掉要不会被重复启动 CPU被占用99其他程序无法正常运行。

原文地址:https://www.cnblogs.com/wupeng88/p/12160315.html