wipefs进程是啥,占用了百分之90多的cpu
这个病毒究竟是如何发起的呢?
貌似这个病毒还会修改两个东西:/usr/sbin/ss/usr/bin/netstat
个人估计还得重装一下这两个包才行。
systemctl status acpidtd.service -l● acpidtd.service - (null) Loaded: loaded (/etc/rc.d/init.d/acpidtd) Active: inactive (dead) since Wed 2017-09-13 16:31:41 CST; 14min ago
Docs: man:systemd-sysv-generator(8)
CGroup: /system.slice/acpidtd.service
└─462 [ata]
Sep 13 13:49:39 myhost systemd[1]: Starting (null)...Sep 13 13:49:39 myhost acpidtd[457]: sh: -c: line 0: syntax error near unexpected token `('Sep 13 13:49:39 myhost acpidtd[457]: sh: -c: line 0: `cp -f /etc/rc.d/init.d/acpidtd (deleted) /usr/sbin/ss 1>/dev/null 2>&1;touch -r /bin/sh /usr/sbin/ss /usr/sbin/scss 1>/dev/null 2>&1;'Sep 13 13:49:39 myhost acpidtd[457]: sh: -c: line 0: syntax error near unexpected token `('Sep 13 13:49:39 myhost acpidtd[457]: sh: -c: line 0: `cp -f /etc/rc.d/init.d/acpidtd (deleted) /usr/bin/netstat 1>/dev/null 2>&1;touch -r /bin/sh /usr/bin/netstat /usr/bin/scnetstat 1>/dev/null 2>&1;'Sep 13 13:49:39 myhost systemd[1]: Started (null).Sep 13 16:31:41 myhost systemd[1]: Stopping (null)...Sep 13 16:31:41 myhost systemd[1]: Stopped (null).Sep 13 16:35:37 myhost systemd[1]: Stopped (null).
赞0
踩0