Срочно обновляйте exim до 4.92 — идёт активное заражение

Зачем так сложно убивать wget, когда существуют команды killall и pkill?
Кстати, в Debian и Ubuntu уязвимость уже исправлена, при этом номер версии exim остался тем же самым. Это я к призыву о том, что необходимо срочно остановить exim. У меня он уже пропатчен. У себя убедиться просмотром файла /usr/share/doc/exim4/changelog.Debian.gz.

Злоумышленники могут запускать на Вашему сервере команды от рута.

#!/bin/sh
echo "Kill kthrotlds..."
while (true) 
do
	pkill -f kthrotlds
	pkill -f ksoftirqds
	pkill -f ldm
	pkill -f npt
	pkill -f ntp
	pkill -f ntpd
	pkill -f nptd
	pkill -f kswapd
	pkill -f onion
	pkill -f tor2web
	chattr -i /tmp/kthrotlds  >/dev/null 2>&1;
	sudo rm -f /tmp/kthrotlds
	chattr -i /etc/rc.d/init.d/kthrotlds  >/dev/null 2>&1;
	sudo rm -f /etc/rc.d/init.d/kthrotlds
	chattr -i /usr/sbin/kthrotlds  >/dev/null 2>&1;
	sudo rm -f /usr/sbin/kthrotlds
	chattr -i "/usr/bin/[kthrotlds]"  >/dev/null 2>&1;
	sudo rm -f "/usr/bin/[kthrotlds]"
	chattr -i "/root/.cache/.ntp"  >/dev/null 2>&1;
	sudo rm -f "/root/.cache/.ntp"
	chattr -i -a /.cache/  >/dev/null 2>&1;
	sudo rm -f "/.cache/.kswapd"
	chattr -i -a /root/.cache/  >/dev/null 2>&1;
	sudo rm -f "/root/.cache/.kswapd"
	chattr -i "/root/.cache/.a"  >/dev/null 2>&1;
	sudo rm -f "/root/.cache/.a"
	
	chattr -i "/usr/bin/["  >/dev/null 2>&1;
	sudo rm -f "/usr/bin/["
	
	chattr -i "/usr/local/bin/npt"  >/dev/null 2>&1;
	sudo rm -f /usr/local/bin/npt
	chattr -i "/usr/local/bin/nptd"  >/dev/null 2>&1;
	sudo rm -f /usr/local/bin/nptd
	
	
	chattr -i -a /etc/cron.d/*  >/dev/null 2>&1;
	chattr -i -a /etc/cron.d/.cronbus  >/dev/null 2>&1;
	sudo rm -rf /etc/cron.d/.cronbus
	sudo rm -rf /etc/cron.d/root
	chattr -i -a /etc/cron.daily/*  >/dev/null 2>&1;
	sudo rm -rf /etc/cron.daily/.cronbus
	sudo rm -rf /etc/cron.daily/root
	chattr -i -a /var/spool/cron/*  >/dev/null 2>&1;
	sudo rm -rf /var/spool/cron/.cronbus
	sudo rm -rf /var/spool/cron/root
	
	
	pkill -f ksoftirqds
	pkill -f kthrotlds
	
	sudo rm -f /etc/ld.so.preload
	sudo rm -f /usr/local/lib/libcset.so
	chattr -i /etc/ld.so.preload  >/dev/null 2>&1;
	sudo rm -f /etc/ld.so.preload
	sudo rm -f /usr/local/lib/libcset.so
	sudo rm -f /tmp/kthrotlds
	sudo rm -f /etc/cron.d/tomcat
	sudo rm -f /etc/cron.d/root
	sudo rm -f /var/spool/cron/root
	sudo rm -f /var/spool/cron/crontabs/root
	sudo rm -f /etc/rc.d/init.d/kthrotlds
	sudo rm -f /usr/sbin/kthrotlds
	sudo rm -f /etc/init.d/netdns
	
	
	
	pkill -f ksoftirqds
	pkill -f kthrotlds
	pkill -f tor2web
	pkill -f onion
	pkill -f hwlh3wlh44lh
	pkill -f Circle_MI
	pkill -f get.bi-chi.com
	pkill -f hashvault.pro
	pkill -f nanopool.org
	pkill -f an7kmd2wp4xo7hpr
	pkill -f "xmr"
	pkill -f "xig"
	pkill -f "ddgs"
	pkill -f "qW3xT"
	pkill -f "wnTKYg"
	pkill -f "t00ls.ru"
	pkill -f "sustes"
	pkill -f "thisxxs"
	pkill -f "hashfish"
	pkill -f "kworkerds"
	pkill -f "systemctI"
	pkill -f "kpsmouseds"
	pkill -f "kthrotlds"
	pkill -f "kintegrityds"
	pkill -f "suolbcc"
	pkill -f khugepageds
	
	crontab -l | grep '192.99.142.226\|82.146.58.234\|83.220.169.247\|91.201.42.5' | crontab -r
	crontab -l | grep 'pastebin.com' | crontab -r
	crontab -l | grep 'gitee.com' | crontab -r
	crontab -l | grep '107.174.47.156' | crontab -r
	crontab -l | grep '83.220.169.24' | crontab -r
	crontab -l | grep '51.38.203.146' | crontab -r
	crontab -l | grep 'mr.sh' | crontab -r
	crontab -l | grep '2mr.sh' | crontab -r
	crontab -l | grep 'cr5.sh' | crontab -r
	crontab -l | grep 'logo9.jpg' | crontab -r
	ps aux | grep '192.99.142.226\|82.146.58.234\|83.220.169.247\|51.68.173.240\|91.201.42.5' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'kworkerdssx -c\' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/dl' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/ddg' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/pprt' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/ppol' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/65ccEJ7\' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/jmxx\' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/2Ne80nA\' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'IOFoqIgyC0zmf2UR'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '45.76.122.92'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '51.38.191.178'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '51.15.56.161'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '86s.jpg'| awk '{print $2}' | xargs kill -9
	#ps aux | grep -v grep | grep 'pastebin.com'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'aGTSGJJp'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'nMrfmnRa'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'PuNY5tm2'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'I0r8Jyyt'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'AgdgACUD'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'uiZvwxG8'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'hahwNEdB'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'BtwXn5qH'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '3XEzey2T'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 't2tKrCSZ'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'HD7fcBgg'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'zXcDajSs'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '3lmigMo'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'AkMK4A2'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'AJ2AkKe'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'HiPxCJRS'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'http_0xCC030'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'http_0xCC031'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'http_0xCC032'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'http_0xCC033'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep "C4iLM4L"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep 'aziplcr72qjhzvin'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | awk '{ if(substr($11,1,2)=="./" && substr($12,1,2)=="./") print $2 }' | xargs kill -9
	ps aux | grep -v grep | grep '/boot/vmlinuz'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep "i4b503a52cc5"| awk '{print $2}'|xargs kill -9
	ps aux | grep -v grep | grep "dgqtrcst23rtdi3ldqk322j2"| awk '{print $2}'|xargs kill -9
	ps aux | grep -v grep | grep "2g0uv7npuhrlatd"| awk '{print $2}'|xargs kill -9
	ps aux | grep -v grep | grep "nqscheduler"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep "rkebbwgqpl4npmm"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep -v aux |grep "]"| awk '$3>10.0{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep "2fhtu70teuhtoh78jc5s"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep "0kwti6ut420t"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep "44ct7udt0patws3agkdfqnjm"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep -v "/" | grep -v "-" | grep -v "_" | awk 'length($11)>19{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep  "\[^" | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep "rsync" | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep "watchd0g" | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | egrep 'wnTKYg|2t3ik|qW3xT.2|ddg' | awk '{print $2}' | xargs kill -9
	#ps aux | grep -v grep | grep " \["|grep watchbog| awk '{print $2}'| xargs kill -9
	#ps aux | grep -v grep | grep " \["|grep bash| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep "158.69.133.18:8220"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep "/tmp/java" | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep 'gitee.com'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/java' | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep '104.248.4.162'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '89.35.39.78'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '104.248.53.213'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '93.113.108.146'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/dev/shm/z3.sh'| awk '{print $2}' | xargs kill -9
	#ps aux | grep -v grep | grep '/bin/bash'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'kthrotlds' | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep '\['|grep 'conflue'| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep 'ksoftirqds' | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep 'netdns' | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep 'watchdogs' | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep -v root | grep -v dblaunch | grep -v dblaunchs | grep -v dblaunched | grep -v apache2 | grep -v atd |awk '$3>10.0{print $2}' | xargs kill -9
	#ps aux | grep -v grep | grep -v aux |grep "\-bash"| awk '{print $2}'| xargs kill -9
	#ps aux | grep -v grep | grep -v bin| grep sshd| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep -v aux | grep " ps"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep "sync_supers" | cut -c 9-15 | xargs kill -9
	ps aux | grep -v grep | grep "cpuset" | cut -c 9-15 | xargs kill -9
	ps aux | grep -v grep | grep -v aux |grep "x]"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep -v aux |grep "x]"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep -v aux |grep "sh] <"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep -v aux |grep " \[]"| awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep '/tmp/l.sh'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/zmcat' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'kblockd' | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep 'khugepageds' | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep 'kerberods' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'ksoftirqds' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'kthrotlds' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'kpsmouseds' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'kintegrityds' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'thyrsi.com'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'z9ls.com' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'curl'| grep 'max-time'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'kthrotld' | awk '{print $2}'| xargs kill -9
	ps aux | grep -v grep | grep 'hahwNEdB'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'CnzFVPLF'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'CvKzzZLs'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'aziplcr72qjhzvin'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '/tmp/udevd'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'YmFzaCAtaSA+JiAvZGV2L3RjcC80NS43Ni4xOTEuMTExLzIwMTIgMD4mMQ'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'dog2.6'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'sustse'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'sustse3'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'mr.sh'| grep 'wget'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'mr.sh'| grep 'curl'| awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '2mr.sh'| grep 'wget' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '2mr.sh'| grep 'curl' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'cr5.sh'| grep 'wget' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'cr5.sh'| grep 'curl' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'logo9.jpg' | grep 'wget' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'logo9.jpg' | grep 'curl' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'j2.conf' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'luk-cpu' | grep 'wget' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'luk-cpu' | grep 'curl' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'ficov' | grep 'wget' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'ficov' | grep 'curl' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'he.sh' | grep 'wget' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'he.sh' | grep 'curl' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'miner.sh' | grep 'wget' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'miner.sh' | grep 'curl' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'nullcrew' | grep 'wget' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep 'nullcrew' | grep 'curl' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '107.174.47.156' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '83.220.169.247' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '51.38.203.146' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '144.217.45.45' | awk '{print $2}' | xargs kill -9	
	ps aux | grep -v grep | grep '107.174.47.181' | awk '{print $2}' | xargs kill -9
	ps aux | grep -v grep | grep '176.31.6.16' | awk '{print $2}' | xargs kill -9
	ps auxf| grep -v grep | grep "mine.moneropool.com"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "pool.t00ls.ru"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "xmr.crypto-pool.fr:8080"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "xmr.crypto-pool.fr:3333"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "zhuabcn@yahoo.com"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "monerohash.com"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "/tmp/a7b104c270"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "xmr.crypto-pool.fr:6666"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "xmr.crypto-pool.fr:7777"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "xmr.crypto-pool.fr:443"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "stratum.f2pool.com:8888"|awk '{print $2}'|xargs kill -9
	ps auxf| grep -v grep | grep "xmrpool.eu" | awk '{print $2}'|xargs kill -9
	ps auxf| grep xiaoyao | awk '{print $2}'|xargs kill -9
	ps auxf| grep xiaoxue | awk '{print $2}'|xargs kill -9
	netstat -antp | grep '46.243.253.15' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
	netstat -antp | grep '176.31.6.16' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
	pgrep -f monerohash|xargs kill -9
	pgrep -f L2Jpbi9iYXN|xargs kill -9
	pgrep -f xzpauectgr|xargs kill -9
	pgrep -f slxfbkmxtd|xargs kill -9
	pgrep -f mixtape|xargs kill -9
	pgrep -f addnj|xargs kill -9
	pgrep -f 200.68.17.196|xargs kill -9
	pgrep -f IyEvYmluL3NoCgpzUG|xargs kill -9
	pgrep -f KHdnZXQgLXFPLSBodHRw|xargs kill -9
	pgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3|xargs kill -9
	pgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo|xargs kill -9
	pgrep -f mwyumwdbpq.conf|xargs kill -9
	pgrep -f honvbsasbf.conf|xargs kill -9
	pgrep -f mqdsflm.cf|xargs kill -9
	pgrep -f stratum|xargs kill -9
	pgrep -f lower.sh|xargs kill -9
	pgrep -f ./ppp|xargs kill -9
	pgrep -f cryptonight|xargs kill -9
	pgrep -f ./seervceaess|xargs kill -9
	pgrep -f ./servceaess|xargs kill -9
	pgrep -f ./servceas|xargs kill -9
	pgrep -f ./servcesa|xargs kill -9
	pgrep -f ./vsp|xargs kill -9
	pgrep -f ./jvs|xargs kill -9
	pgrep -f ./pvv|xargs kill -9
	pgrep -f ./vpp|xargs kill -9
	pgrep -f ./pces|xargs kill -9
	pgrep -f ./rspce|xargs kill -9
	pgrep -f ./haveged|xargs kill -9
	pgrep -f ./jiba|xargs kill -9
	pgrep -f ./watchbog|xargs kill -9
	pgrep -f ./A7mA5gb|xargs kill -9  
	pgrep -f kacpi_svc|xargs kill -9
	pgrep -f kswap_svc|xargs kill -9
	pgrep -f kauditd_svc|xargs kill -9
	pgrep -f kpsmoused_svc|xargs kill -9
	pgrep -f kseriod_svc|xargs kill -9
	pgrep -f kthreadd_svc|xargs kill -9
	pgrep -f ksoftirqd_svc|xargs kill -9
	pgrep -f kintegrityd_svc|xargs kill -9
	pgrep -f jawa|xargs kill -9
	pgrep -f oracle.jpg|xargs kill -9
	pgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN|xargs kill -9
	pgrep -f 188.209.49.54|xargs kill -9
	pgrep -f 181.214.87.241|xargs kill -9
	pgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ|xargs kill -9
	pgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj|xargs kill -9
	pgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK|xargs kill -9
	pgrep -f servim|xargs kill -9
	pgrep -f kblockd_svc|xargs kill -9
	pgrep -f native_svc|xargs kill -9
	pgrep -f sshd2|xargs kill -9
	pgrep -f ynn|xargs kill -9
	pgrep -f perl|xargs kill -9
	pgrep -f 65ccEJ7|xargs kill -9
	pgrep -f jmxx|xargs kill -9
	pgrep -f 2Ne80nA|xargs kill -9
	pgrep -f sysstats|xargs kill -9
	pgrep -f systemxlv|xargs kill -9
	pgrep -f watchbog|xargs kill -9
	pgrep -f OIcJi1m|xargs kill -9
	pkill -f biosetjenkins
	pkill -f Loopback
	pkill -f apaceha
	pkill -f cryptonight
	pkill -f stratum
	pkill -f mixnerdx
	pkill -f performedl
	pkill -f JnKihGjn
	pkill -f irqba2anc1
	pkill -f irqba5xnc1
	pkill -f irqbnc1
	pkill -f ir29xc1
	pkill -f conns
	pkill -f irqbalance
	pkill -f crypto-pool
	pkill -f XJnRj
	pkill -f mgwsl
	pkill -f pythno
	pkill -f jweri
	pkill -f lx26
	pkill -f NXLAi
	pkill -f BI5zj
	pkill -f askdljlqw
	pkill -f minerd
	pkill -f minergate
	pkill -f Guard.sh
	pkill -f ysaydh
	pkill -f bonns
	pkill -f donns
	pkill -f kxjd
	pkill -f Duck.sh
	pkill -f bonn.sh
	pkill -f conn.sh
	pkill -f kworker34
	pkill -f kw.sh
	pkill -f pro.sh
	pkill -f polkitd
	pkill -f acpid
	pkill -f icb5o
	pkill -f nopxi
	pkill -f irqbalanc1
	pkill -f minerd
	pkill -f i586
	pkill -f gddr
	pkill -f mstxmr
	pkill -f ddg.2011
	pkill -f wnTKYg
	pkill -f deamon
	pkill -f disk_genius
	pkill -f sourplum
	pkill -f polkitd
	pkill -f nanoWatch
	pkill -f zigw	
	pkill -f devtool	
	pkill -f devtools	
	pkill -f systemctI	
	pkill -f watchbog
	pkill -f cryptonight
	pkill -f sustes
	pkill -f xmrig
	pkill -f xmr-stak
	pkill -f suppoie
	pkill -f zer0day.ru
	pkill -f dbus-daemon--system
	pkill -f nullcrew
	pkill -f systemctI
	pkill -f kworkerds
	pkill -f init10.cfg
	pkill -f /wl.conf
	pkill -f crond64
	pkill -f sustse
	pkill -f vmlinuz
	sudo rm -rf /tmp/wc.conf
	sudo rm -rf /tmp/sustse
	sudo rm -rf /tmp/php
	sudo rm -rf /tmp/p2.conf
	sudo rm -rf /tmp/pprt
	sudo rm -rf /tmp/ppol
	sudo rm -rf /tmp/javax/config.sh
	sudo rm -rf /tmp/javax/sshd2
	sudo rm -rf /tmp/.profile
	sudo rm -rf /tmp/1.so
	sudo rm -rf /tmp/kworkerds
	sudo rm -rf /tmp/kworkerds3
	sudo rm -rf /tmp/kworkerdssx
	sudo rm -rf /tmp/xd.json
	sudo rm -rf /tmp/syslogd
	sudo rm -rf /tmp/syslogdb 
	sudo rm -rf /tmp/65ccEJ7
	sudo rm -rf /tmp/jmxx
	sudo rm -rf /tmp/2Ne80nA
	sudo rm -rf /tmp/dl
	sudo rm -rf /tmp/ddg
	sudo rm -rf /tmp/systemxlv
	sudo rm -rf /tmp/systemctI
	sudo rm -rf /tmp/.abc
	sudo rm -rf /tmp/osw.hb
	sudo rm -rf /tmp/.tmpleve
	sudo rm -rf /tmp/.tmpnewzz  
	sudo rm -rf /tmp/.java  
	sudo rm -rf /tmp/.omed
	sudo rm -rf /tmp/.tmpc
	sudo rm -rf /tmp/.tmpleve
	sudo rm -rf /tmp/.tmpnewzz
	sudo rm -rf /tmp/gates.lod
	sudo rm -rf /tmp/conf.n
	sudo rm -rf /tmp/update.sh
	sudo rm -rf /tmp/devtool
	sudo rm -rf /tmp/devtools
	sudo rm -rf /tmp/fs
	sudo rm -rf /tmp/.rod
	sudo rm -rf /tmp/.rod.tgz
	sudo rm -rf /tmp/.rod.tgz.1
	sudo rm -rf /tmp/.rod.tgz.2
	sudo rm -rf /tmp/.mer
	sudo rm -rf /tmp/.mer.tgz
	sudo rm -rf /tmp/.mer.tgz.1
	sudo rm -rf /tmp/.hod
	sudo rm -rf /tmp/.hod.tgz
	sudo rm -rf /tmp/.hod.tgz.1
	sudo rm -rf /tmp/84Onmce
	sudo rm -rf /tmp/C4iLM4L
	sudo rm -rf /tmp/lilpip
	sudo rm -rf /tmp/3lmigMo
	sudo rm -rf /tmp/am8jmBP
	sudo rm -rf /tmp/tmp.txt
	sudo rm -rf /tmp/baby
	sudo rm -rf /tmp/.lib
	sudo rm -rf /tmp/systemd
	sudo rm -rf /tmp/lib.tar.gz
	sudo rm -rf /tmp/baby
	sudo rm -rf /tmp/java
	sudo rm -rf /tmp/j2.conf
	sudo rm -rf /tmp/.mynews1234
	sudo rm -rf /tmp/a3e12d
	sudo rm -rf /tmp/.pt
	sudo rm -rf /tmp/.pt.tgz
	sudo rm -rf /tmp/.pt.tgz.1
	sudo rm -rf /tmp/go
	sudo rm -rf /tmp/java
	sudo rm -rf /tmp/j2.conf
	sudo rm -rf /tmp/.tmpnewasss
	sudo rm -rf /tmp/java
	sudo rm -rf /tmp/go.sh
	sudo rm -rf /tmp/go2.sh
	sudo rm -rf /tmp/.censusqqqqqqqqq
	sudo rm -rf /tmp/.kerberods
	sudo rm -rf /tmp/kerberods
	sudo rm -rf /tmp/seasame
	sudo rm -rf /tmp/touch
	sudo rm -rf /tmp/.p
	sudo rm -rf /tmp/runtime2.sh
	sudo rm -rf /tmp/runtime.sh
	sudo rm -f /usr/sbin/kerberods
	sudo rm -f /usr/sbin/kthrotlds
	sudo rm -f /usr/sbin/kintegrityds
	sudo rm -f /usr/sbin/kpsmouseds
	sudo rm -f /etc/rc.d/init.d/kerberods
	sudo rm -f /etc/init.d/netdns
	sudo rm -f /etc/rc.d/init.d/kthrotlds
	sudo rm -f /etc/rc.d/init.d/kpsmouseds
	sudo rm -f /etc/rc.d/init.d/kintegrityds
	sudo rm -rf /dev/shm/z3.sh
	sudo rm -rf /dev/shm/z2.sh
	sudo rm -rf /dev/shm/.scr
	sudo rm -rf /dev/shm/.kerberods
	sudo rm -f /etc/ld.so.preload
	sudo rm -f /usr/local/lib/libioset.so
	chattr -i /etc/ld.so.preload
	sudo rm -f /etc/ld.so.preload
	sudo rm -f /usr/local/lib/libioset.so
	sudo rm -rf /tmp/watchdogs
	sudo rm -rf /etc/cron.d/tomcat
	sudo rm -rf /etc/cron.d/root
	sudo rm -rf /var/spool/cron/root
	sudo rm -rf /var/spool/cron/crontabs/root
	sudo rm -rf /etc/rc.d/init.d/watchdogs
	sudo rm -rf /usr/sbin/watchdogs
	sudo rm -f /tmp/kthrotlds
	sudo rm -f /etc/rc.d/init.d/kthrotlds
	sudo rm -rf /tmp/.sysbabyuuuuu12
	sudo rm -rf /tmp/logo9.jpg
	sudo rm -rf /tmp/miner.sh
	sudo rm -rf /tmp/nullcrew
	sudo rm -rf /tmp/proc
	sudo rm -rf /tmp/2.sh
	sudo rm -rf /tmp/.XIMunix
	sudo rm -f /var/tmp/dog2.61
	sudo rm -f /var/tmp/prot
	sudo rm -f /tmp/prot
	sudo rm -f /usr/sbin/kerberods
	sudo rm -f /usr/sbin/kthrotlds
	sudo rm -f /usr/sbin/kintegrityds
	sudo rm -f /usr/sbin/kpsmouseds
	sudo rm /opt/atlassian/confluence/bin/1.sh
	sudo rm /opt/atlassian/confluence/bin/1.sh.1
	sudo rm /opt/atlassian/confluence/bin/1.sh.2
	sudo rm /opt/atlassian/confluence/bin/1.sh.3
	sudo rm /opt/atlassian/confluence/bin/3.sh
	sudo rm /opt/atlassian/confluence/bin/3.sh.1
	sudo rm /opt/atlassian/confluence/bin/3.sh.2
	sudo rm /opt/atlassian/confluence/bin/3.sh.3
	sudo rm -rf /var/tmp/f41
	sudo rm -rf /var/tmp/2.sh
	sudo rm -rf /var/tmp/config.json
	sudo rm -rf /var/tmp/xmrig
	sudo rm -rf /var/tmp/1.so
	sudo rm -rf /var/tmp/kworkerds3
	sudo rm -rf /var/tmp/kworkerdssx
	sudo rm -rf /var/tmp/kworkerds
	sudo rm -rf /var/tmp/wc.conf
	sudo rm -rf /var/tmp/nadezhda.
	sudo rm -rf /var/tmp/nadezhda.arm
	sudo rm -rf /var/tmp/nadezhda.arm.1
	sudo rm -rf /var/tmp/nadezhda.arm.2
	sudo rm -rf /var/tmp/nadezhda.x86_64
	sudo rm -rf /var/tmp/nadezhda.x86_64.1
	sudo rm -rf /var/tmp/nadezhda.x86_64.2
	sudo rm -rf /var/tmp/sustse3
	sudo rm -rf /var/tmp/sustse
	sudo rm -rf /var/tmp/moneroocean/
	sudo rm -rf /var/tmp/config.json
	sudo rm -rf /var/tmp/devtool
	sudo rm -rf /var/tmp/devtools
	sudo rm -rf /var/tmp/play.sh
	sudo rm -rf /var/tmp/systemctI
	sudo rm -rf /var/tmp/update.sh
	sudo rm -rf /var/tmp/.java
	sudo rm -rf /var/tmp/1.sh
	sudo rm -rf /var/tmp/conf.n
	sudo rm -R -f  /tmp/khugepageds
	sudo rm -rf /tmp/khugepageds
	sudo rm -r /var/tmp/lib
	sudo rm -r /var/tmp/.lib
	touch /tmp/lok
	mkdir -p /tmp/khugepageds
	sudo rm -rf /var/tmp/yum-confluence-*
	
	chattr -i /root/.ssh/authorized_keys
	sudo rm -f /root/.ssh/authorized_keys
	cp /root/.ssh/1/authorized_keys /root/.ssh/authorized_keys
	
	sleep 1;
done;
	

cp /root/.ssh/1/authorized_keys /root/.ssh/authorized_keys

kill.sh 2> /dev/null > /dev/null &

#!/usr/bin/env sh

# 清除定时任务
(service crond stop || systemctl restart crond || /etc/init.d/cron stop)|sh
busybox rm -f /etc/cron.d/root
busybox rm -f /var/spool/cron/root
busybox rm -f /var/spool/cron/crontabs/root

# 清除恶意Hook库
busybox rm -f /etc/ld.so.preload
busybox rm -f /usr/local/lib/libcset.so
chattr -i /etc/ld.so.preload
busybox rm -f /etc/ld.so.preload
busybox rm -f /usr/local/lib/libcset.so

# 清理异常进程
busybox ps -ef | busybox grep -v grep | busybox egrep 'ksoftirqds' | busybox awk '{print $1}' | busybox xargs kill -9
busybox ps -ef | busybox grep -v grep | busybox egrep 'kthrotlds' | busybox awk '{print $1}' | busybox xargs kill -9
busybox rm -f /tmp/kthrotlds
busybox rm -f /usr/sbin/kthrotlds

# 清理开机启动项
chkconfig netdns off
chkconfig –del netdns
systemctl disable netdns
busybox rm -f /etc/rc.d/init.d/kthrotlds
busybox rm -f /etc/init.d/netdns

# 重新共享动态链接库
ldconfig

# 再次清理异常进程
busybox ps -ef | busybox grep -v grep | busybox egrep 'ksoftirqds' | busybox awk '{print $1}' | busybox xargs kill -9
busybox ps -ef | busybox grep -v grep | busybox egrep 'kthrotlds' | busybox awk '{print $1}' | busybox xargs kill -9

service crond start
echo «Done, Please reboot!»

Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirror.sale-dedic.com
* epel: ru.download.ispsystem.com
* epel-testing: mirror.logol.ru
* extras: mirror.reconn.ru
* ispsystem-5.129: download.ispsystem.com
* ispsystem-base: ru.download.ispsystem.com
* updates: mirror.sale-dedic.com
Resolving Dependencies
--> Running transaction check
---> Package exim.x86_64 0:4.84.2-2.el7 will be updated
---> Package exim.x86_64 0:4.92-1.el7 will be an update
--> Processing Dependency: libcrypto.so.10(OPENSSL_1.0.2)(64bit) for package: exim-4.92-1.el7.x86_64
--> Running transaction check
---> Package openssl-libs.x86_64 1:1.0.1e-51.el7_2.7 will be updated
--> Processing Dependency: openssl-libs(x86-64) = 1:1.0.1e-51.el7_2.7 for package: 1:openssl-1.0.1e-51.el7_2.7.x86_64
---> Package openssl-libs.x86_64 1:1.0.2k-16.el7_6.1 will be an update
--> Running transaction check
---> Package openssl.x86_64 1:1.0.1e-51.el7_2.7 will be updated
---> Package openssl.x86_64 1:1.0.2k-16.el7_6.1 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
Package Arch Version Repository Size
================================================================================
Updating:
exim x86_64 4.92-1.el7 epel 1.4 M
Updating for dependencies:
openssl x86_64 1:1.0.2k-16.el7_6.1 updates 493 k
openssl-libs x86_64 1:1.0.2k-16.el7_6.1 updates 1.2 M

Transaction Summary
================================================================================
Upgrade 1 Package (+2 Dependent packages)

Total download size: 3.1 M
Is this ok [y/d/N]: Exiting on user command

Как хорошо, что использую dovecot. Можно читать статью и комментарии не спеша. ;)