服务器被人放了门罗币挖矿程序(XMRIG),能分析出来些啥吗

2018-07-04 16:28:35 +08:00
 wangfei324017

大约 3-4 台服务器被发现中了,现在把这些文件彻底删除了,修改了电脑账号的密码,不知道这样子是不是就安全了……

{ "algo": "cryptonight", // cryptonight (default) or cryptonight-lite "av": 0, // algorithm variation, 0 auto select "background": false, // true to run the miner in the background "colors": true, // false to disable colored output
"cpu-affinity": null, // set process affinity to CPU core(s), mask "0x3" for cores 0 and 1 "cpu-priority": null, // set process priority (0 idle, 2 normal to 5 highest) "donate-level": 5, // donate level, mininum 1% "log-file": null, // log all output to a file, example: "c:/some/path/xmrig.log" "max-cpu-usage": 100, // maximum CPU usage for automatic mode, usually limiting factor is CPU cache not this option.
"print-time": 60, // print hashrate report every N seconds "retries": 5, // number of times to retry before switch to backup server "retry-pause": 5, // time to pause between retries "safe": false, // true to safe adjust threads and av settings for current CPU "threads": null, // number of miner threads "pools": [ { "url": "pool.supportxmr.com:5555", // URL of mining server "user": "43YVXSRrqzejHN1UNmQ9gtRhmRJQn472pbXoqmtsBeGZBf7w5eNXUVsWbwaVe4vUMveKAzAiA4j8xgUi29TpKXpm3x4ZNk7", // username for mining server "pass": "x", // password for mining server "keepalive": true, // send keepalived for prevent timeout (need pool support) "nicehash": false, // enable nicehash/xmrig-proxy support "variant": -1 // algorithm PoW variant } ], "api": { "port": 0, // port for the miner API https://github.com/xmrig/xmrig/wiki/API "access-token": null, // access token for API "worker-id": null // custom worker-id for API } }

7405 次点击
所在节点    信息安全
7 条回复
wangfei324017
2018-07-04 16:29:24 +08:00
图片
crab
2018-07-04 16:45:47 +08:00
只改密码治标不治本啊(除非确定是因为密码被破解)
找出被入侵的原因吧。(建议是系统重装,而不是只改密码。)
sphawkcn
2018-07-04 17:14:48 +08:00
既然是服务器,那就不要用密码了,用密钥吧。
wangfei324017
2018-07-04 19:12:08 +08:00
@sphawkcn windows 服务器也可以用密钥嘛……
wangfei324017
2018-07-04 19:12:48 +08:00
@crab 3q
Heyuan
2019-08-28 14:55:06 +08:00
请问解决了吗,我重装系统还是会有这个矿木马
wangfei324017
2019-08-29 17:52:42 +08:00
@Heyuan #6 我好像把他删了就好了

这是一个专为移动设备优化的页面(即为了让你能够在 Google 搜索结果里秒开这个页面),如果你希望参与 V2EX 社区的讨论,你可以继续到 V2EX 上打开本讨论主题的完整版本。

https://www.v2ex.com/t/468110

V2EX 是创意工作者们的社区,是一个分享自己正在做的有趣事物、交流想法,可以遇见新朋友甚至新机会的地方。

V2EX is a community of developers, designers and creative people.

© 2021 V2EX