Linux服务器中木马wnTKYg

1、修改服务器密码

Top命令查看，发现cpu过高

[root@localhost ~]# top

修改密码

[root@localhost ~]# passwd root

2、停用进程

[root@localhost ~]#Kill -9 1174

3、删除tmp中文件

[root@localhost ~]# cd /tmp/

[root@localhost ~]# rm -rf *ddg*

4、删除定时任务

[root@localhost ~]# crontab -e

ps -ef|grep -v grep|grep "imWBR1"|awk ‘{print $2}‘|xargs kill -9

ps -ef|grep -v grep|grep "ddgs"|awk ‘{print $2}‘|xargs kill -9

ps -ef|grep -v grep|grep "wnTKYg"|awk ‘{print $2}‘|xargs kill -9

echo ‘‘ > /var/spool/cron/root

echo ‘‘ > /var/spool/cron/crontabs/root

rm -rf /var/spool/cron/*

rm -rf /tmp/*

mv /usr/bin/curl /usr/bin/curl.bak

mv /usr/bin/wget /usr/bin/wget.bak

Linux服务器中木马wnTKYg

原文：https://www.cnblogs.com/bingmengzhang/p/10069445.html