某销售公司电子商务网站被黑redhat6.1tomcat

硬件：HP380 2U

OS ： redhat6.1

中间件：tomcat

JSP网站。

某公司电子商务网站系统一直不正常

系统总是资源耗尽，然后系统奔溃

参考网站服务故障描述：

http://blog.csdn.net/huzia/article/details/18941767

观察日志发现，邮件日志不正常，入侵病毒不停地给雅虎的某个电子邮件接受端
发送电子邮件

Jan 31 10:36:29 ZMESCMDZSW01 postfix/qmgr[3574]: 07997200A4E: from=<root@ZMESCMDZSW01.localdomain>, size=13065, nrcpt=1 (queue active)
Jan 31 10:36:29 ZMESCMDZSW01 postfix/qmgr[3574]: C1E8A200A59: from=<root@ZMESCMDZSW01.localdomain>, size=25541, nrcpt=1 (queue active)
Jan 31 10:36:29 ZMESCMDZSW01 postfix/smtp[50358]: C1E8A200A59: to=<vrajealla123@yahoo.com>, relay=none, delay=378402, delays=378402/0.01/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yahoo.com type=MX: Host not found, try again)
Jan 31 10:36:29 ZMESCMDZSW01 postfix/smtp[50340]: 07997200A4E: to=<vrajealla123@yahoo.com>, relay=none, delay=378402, delays=378402/0.06/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yahoo.com type=MX: Host not found, try again)
Jan 31 11:46:29 ZMESCMDZSW01 postfix/qmgr[3574]: 07997200A4E: from=<root@ZMESCMDZSW01.localdomain>, size=13065, nrcpt=1 (queue active)
Jan 31 11:46:29 ZMESCMDZSW01 postfix/qmgr[3574]: C1E8A200A59: from=<root@ZMESCMDZSW01.localdomain>, size=25541, nrcpt=1 (queue active)
Jan 31 11:46:29 ZMESCMDZSW01 postfix/smtp[5180]: C1E8A200A59: to=<vrajealla123@yahoo.com>, relay=none, delay=382603, delays=382603/0.03/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yahoo.com type=MX: Host not found, try again)
Jan 31 11:46:29 ZMESCMDZSW01 postfix/smtp[5133]: 07997200A4E: to=<vrajealla123@yahoo.com>, relay=none, delay=382603, delays=382603/0.16/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yahoo.com type=MX: Host not found, try again)
Jan 31 12:56:29 ZMESCMDZSW01 postfix/qmgr[3574]: 07997200A4E: from=<root@ZMESCMDZSW01.localdomain>, size=13065, nrcpt=1 (queue active)
Jan 31 12:56:29 ZMESCMDZSW01 postfix/qmgr[3574]: C1E8A200A59: from=<root@ZMESCMDZSW01.localdomain>, size=25541, nrcpt=1 (queue active)
Jan 31 12:56:29 ZMESCMDZSW01 postfix/smtp[45070]: C1E8A200A59: to=<vrajealla123@yahoo.com>, relay=none, delay=386803, delays=386803/0.01/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yahoo.com type=MX: Host not found, try again)
Jan 31 12:56:29 ZMESCMDZSW01 postfix/smtp[45054]: 07997200A4E: to=<vrajealla123@yahoo.com>, relay=none, delay=386803, delays=386803/0.03/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yahoo.com type=MX: Host not found, try again)
Jan 31 14:06:29 ZMESCMDZSW01 postfix/qmgr[3574]: 07997200A4E: from=<root@ZMESCMDZSW01.localdomain>, size=13065, nrcpt=1 (queue active)
Jan 31 14:06:30 ZMESCMDZSW01 postfix/qmgr[3574]: C1E8A200A59: from=<root@ZMESCMDZSW01.localdomain>, size=25541, nrcpt=1 (queue active)
Jan 31 14:06:30 ZMESCMDZSW01 postfix/smtp[10303]: C1E8A200A59: to=<vrajealla123@yahoo.com>, relay=none, delay=391003, delays=391003/0.04/0.02/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yahoo.com type=MX: Host not found, try again)
^C

查看是否有异常的定时任务

[root@ZMESCMDZSW01 log]# crontab -l
1 1 10 * * ~/.sysdbs
1 1 24 * * perl ~/.sysync.pl
1 1 24 * * perl ~/.sysync.pl
1 1 10 * * ~/.sysdbs

妈的，异常启动的perl进程，就这几个家伙倒得鬼。

问题已经基本清楚了。

注销这几个自动启动进程

[root@ESCMDZSW01 ~]# crontab -e

#1 1 10 * * ~/.sysdbs
#1 1 24 * * perl ~/.sysync.pl
#1 1 24 * * perl ~/.sysync.pl
#1 1 10 * * ~/.sysdbs
~
~

[root@ZMESCMDZSW01 log]#

root@ZMESCMDZSW01 ~]# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin ----------------这里是对的
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
rtkit:x:499:496:RealtimeKit:/proc:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
saslauth:x:498:495:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pulse:x:497:494:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
oprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
[root@ZMESCMDZSW01 ~]#

top输出

6:50pm up 1 day, 22:42, 2 users, load average: 0.04, 0.13, 0.30
874 processes: 873 sleeping, 1 running, 0 zombie, 0 stopped
CPU states: 0.0% user, 0.2% system, 0.0% nice, 0.5% idle
Mem: 32843076K av, 3715880K used, 29127196K free, 0K shrd, 269536K buff
Swap: 35078136K av, 0K used, 35078136K free 963532K cached

PID USER PRI NI SIZE RSS SHARE STAT LIB %CPU %MEM TIME COMMAND
32004 root 20 0 2924 1532 844 R 0 5.7 0.0 0:00 top
258 root 20 0 0 0 0 SW 0 0.9 0.0 0:16 ata/21
3177 root 20 0 4060 308 220 S 0 0.9 0.0 5:04 cpuspeed
3181 root 20 0 4060 304 216 S 0 0.9 0.0 5:04 cpuspeed
3185 root 20 0 4060 304 216 S 0 0.9 0.0 5:02 cpuspeed
3191 root 20 0 4060 304 216 S 0 0.9 0.0 5:01 cpuspeed
3209 root 20 0 4060 304 216 S 0 0.9 0.0 5:03 cpuspeed
3212 root 20 0 4060 304 216 S 0 0.9 0.0 5:05 cpuspeed
3214 root 20 0 4060 304 216 S 0 0.9 0.0 5:04 cpuspeed
3217 root 20 0 4060 304 216 S 0 0.9 0.0 5:04 cpuspeed
3300 dbus 20 0 98252 2340 952 S 0 0.9 0.0 0:32 dbus-daemon
12680 root 20 0 1485M 322M 16916 S 0 0.9 1.0 43:19 java
50326 root 20 0 9432 1308 1012 S 0 0.9 0.0 0:07 gam_server
1 root 20 0 19328 1512 1212 S 0 0.0 0.0 0:04 init
2 root 20 0 0 0 0 SW 0 0.0 0.0 0:00 kthreadd
3 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/0
4 root 20 0 0 0 0 SW 0 0.0 0.0 0:00 ksoftirqd/0
5 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/0
6 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 watchdog/0
7 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/1
8 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/1
9 root 20 0 0 0 0 SW 0 0.0 0.0 0:00 ksoftirqd/1
10 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 watchdog/1
11 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/2
12 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/2
13 root 20 0 0 0 0 SW 0 0.0 0.0 0:00 ksoftirqd/2
14 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 watchdog/2
15 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/3
16 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/3
17 root 20 0 0 0 0 SW 0 0.0 0.0 0:00 ksoftirqd/3
18 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 watchdog/3
19 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/4
20 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 migration/4
21 root 20 0 0 0 0 SW 0 0.0 0.0 0:00 ksoftirqd/4
22 root 0K 0 0 0 0 SW 0 0.0 0.0 0:00 watchdog/4

下面是正常的top输出，上面和下面明显不对
[root@ZMESCMDZSW01 ~]#top
top - 18:51:49 up 1 day, 22:31, 2 users, load average: 0.17, 0.40, 0.43
Tasks: 823 total, 1 running, 822 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.0%us, 0.2%sy, 0.0%ni, 99.6%id, 0.2%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 32843076k total, 1445164k used, 31397912k free, 95348k buffers
Swap: 35078136k total, 0k used, 35078136k free, 232384k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
56598 root 20 0 15548 1692 820 R 4.7 0.0 0:00.16 top
3133 root 20 0 4060 276 180 S 1.6 0.0 5:01.02 cpuspeed
3134 root 20 0 4060 312 216 S 1.6 0.0 5:01.69 cpuspeed
3140 root 20 0 4060 276 180 S 1.6 0.0 5:01.39 cpuspeed
3144 root 20 0 4060 276 180 S 1.6 0.0 5:01.30 cpuspeed
3146 root 20 0 4060 312 216 S 1.6 0.0 5:01.32 cpuspeed
3149 root 20 0 4060 312 216 S 1.6 0.0 5:01.16 cpuspeed
3155 root 20 0 4060 312 216 S 1.6 0.0 5:01.39 cpuspeed
3167 root 20 0 4060 276 180 S 1.6 0.0 5:01.86 cpuspeed
1 root 20 0 19324 1512 1212 S 0.0 0.0 0:03.17 init
2 root 20 0 0 0 0 S 0.0 0.0 0:00.02 kthreadd
3 root RT 0 0 0 0 S 0.0 0.0 0:00.01 migration/0
4 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
5 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
6 root RT 0 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
7 root RT 0 0 0 0 S 0.0 0.0 0:00.01 migration/1
8 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/1
9 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1
10 root RT 0 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
11 root RT 0 0 0 0 S 0.0 0.0 0:00.01 migration/2
12 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/2
13 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/2
14 root RT 0 0 0 0 S 0.0 0.0 0:00.01 watchdog/2
15 root RT 0 0 0 0 S 0.0 0.0 0:00.02 migration/3
16 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/3
17 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/3
18 root RT 0 0 0 0 S 0.0 0.0 0:00.02 watchdog/3
19 root RT 0 0 0 0 S 0.0 0.0 0:00.01 migration/4
20 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/4
21 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/4
22 root RT 0 0 0 0 S 0.0 0.0 0:00.01 watchdog/4
23 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/5
24 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/5
25 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/5
26 root RT 0 0 0 0 S 0.0 0.0 0:00.09 watchdog/5
[root@ZMESCMDZSW02 log]#

第一行：前面有个空格
第三行：cpu显示
第五行：swap显示
还有字体，上面部分与下面进程 显示部分完全不是一个字体
立刻想到的就是系统命令被人替换了
查看top命令的信息
-rwxr-xr-x 1 122 114 33992 Mar 31 2010 /usr/bin/top

属主、属组都是那么的诡异，122类似这样的用户一般为上传文件所拥有
具体看一下文件大小
[root@ZMESCMDZSW01 ~]# ll -ha /usr/bin/top
ls：无效选项 -- h
Try `ls --help' for more information.
[root@ZMESCMDZSW01 ~]#

find / -user 122 | xargs ls -l
[root@ZMESCMDZSW01 ~]# find / -user 122 | xargs ls -l
find: “/proc/33319/task/33319/fd/5”: 没有那个文件或目录
find: “/proc/33319/task/33319/fdinfo/5”: 没有那个文件或目录
find: “/proc/33319/fd/5”: 没有那个文件或目录
find: “/proc/33319/fdinfo/5”: 没有那个文件或目录
-rwxr-xr-x 1 122 114 39696 Mar 10 2011 /bin/ls
-rwxr-xr-x 1 122 114 54152 Mar 15 2011 /bin/netstat
-rwxr-xr-x 1 122 114 62920 Mar 17 2011 /bin/ps
-rwx------ 1 122 114 525 Apr 17 2003 /lib/libsh.so/shhk
-rwx------ 1 122 114 329 Apr 17 2003 /lib/libsh.so/shhk.pub
-rwx------ 1 122 114 512 Jan 27 01:29 /lib/libsh.so/shrs
-rwxr-xr-x 1 122 114 31504 Mar 15 2011 /sbin/ifconfig
-rwxr-xr-x 1 122 114 212747 Mar 10 2011 /sbin/ttyload
-rwxrwxr-x 1 122 114 93476 Mar 10 2011 /sbin/ttymon
-rwxr-xr-x 1 122 114 39696 Mar 10 2011 /usr/bin/dir
-rwxr-xr-x 1 122 114 59536 Jun 16 2010 /usr/bin/find
-rwxr-xr-x 1 122 114 31452 Mar 10 2011 /usr/bin/md5sum
-rwxr-xr-x 1 122 114 12340 Jan 12 2011 /usr/bin/pstree
-rwxr-xr-x 1 122 114 33992 Mar 17 2011 /usr/bin/top
-rwxr-xr-x 1 122 114 1206 Apr 18 2003 /usr/lib/libsh/.bashrc
-rwxr-xr-x 1 122 114 7578 Mar 10 2011 /usr/lib/libsh/.sniff/shp
-rwxr-xr-x 1 122 114 16070 Mar 10 2011 /usr/lib/libsh/.sniff/shsniff
-rwxr-xr-x 1 122 114 2000 Mar 10 2011 /usr/lib/libsh/hide
-rwxr-xr-x 1 122 114 1345 Mar 10 2011 /usr/lib/libsh/shsb
-rwxr-xr-x 1 122 114 82628 Jun 28 2010 /usr/sbin/lsof
[root@ZMESCMDZSW01 ~]#

find / -user 122 | xargs lsattr
[root@ZMESCMDZSW01 ~]# cd /bin/ls
-bash: cd: /bin/ls: 不是目录
[root@ZMESCMDZSW01 ~]# cd /bin
[root@ZMESCMDZSW01 bin]# mv ls ls_bak
[root@ZMESCMDZSW01 bin]# cd /sbin/ttyload
-bash: cd: /sbin/ttyload: 不是目录
[root@ZMESCMDZSW01 bin]# cd /sbin
[root@ZMESCMDZSW01 sbin]# mv ttyload ttyload20140208
[root@ZMESCMDZSW01 sbin]# mv ttyload ttymon20140208
mv: 无法获取"ttyload" 的文件状态(stat): 没有那个文件或目录
[root@ZMESCMDZSW01 sbin]# mv ttyload ttymon20140208
mv: 无法获取"ttyload" 的文件状态(stat): 没有那个文件或目录
[root@ZMESCMDZSW01 sbin]# ls tty*
-bash: /bin/ls: 没有那个文件或目录
[root@ZMESCMDZSW01 sbin]# ls *
-bash: /bin/ls: 没有那个文件或目录
[root@ZMESCMDZSW01 sbin]# cd /bin
[root@ZMESCMDZSW01 bin]# sftp root@192.168.1.72
Connecting to 192.168.1.72...
root@192.168.1.72's password:
sftp> cd bin
Couldn't canonicalise: No such file or directory
sftp> cd /bin
sftp> get ls
Fetching /bin/ls to ls
/bin/ls 100% 114KB 114.3KB/s 00:00
sftp> exit
[root@ZMESCMDZSW01 bin]# ls
alsaunmute csh env kill mv rvi traceroute6
arch cut ex link nano rview true
awk dash false ln netstat sed ulockmgr_server
basename date fgrep loadkeys nice setfont umount
bash dbus-cleanup-sockets find login nisdomainname setserial uname
cat dbus-daemon findmnt ls ping sh unicode_start
cgclassify dbus-monitor fusermount ls_bak ping6 sleep unicode_stop
cgcreate dbus-send gawk lsblk plymouth sort unlink
cgdelete dbus-uuidgen gettext lscgroup ps stty usleep
cgexec dd grep lssubsys pwd su vi
cgget df gtar mail raw sync view
cgset dmesg gunzip mailx readlink tar ypdomainname
cgsnapshot dnsdomainname gzip mkdir red taskset zcat
chgrp domainname hostname mknod redhat_lsb_init tcsh
chmod dumpkeys ipcalc mktemp rm touch
chown echo iptables-xml more rmdir tracepath
cp ed kbd_mode mount rnano tracepath6
cpio egrep keyctl mountpoint rpm traceroute

如下所示ls命令已经修复。

[root@ZMESCMDZSW01 bin]# ls
alsaunmute csh env kill mv rvi traceroute6
arch cut ex link nano rview true
awk dash false ln netstat sed ulockmgr_server
basename date fgrep loadkeys nice setfont umount
bash dbus-cleanup-sockets find login nisdomainname setserial uname
cat dbus-daemon findmnt ls ping sh unicode_start
cgclassify dbus-monitor fusermount ls_bak ping6 sleep unicode_stop
cgcreate dbus-send gawk lsblk plymouth sort unlink
cgdelete dbus-uuidgen gettext lscgroup ps stty usleep
cgexec dd grep lssubsys pwd su vi
cgget df gtar mail raw sync view
cgset dmesg gunzip mailx readlink tar ypdomainname
cgsnapshot dnsdomainname gzip mkdir red taskset zcat
chgrp domainname hostname mknod redhat_lsb_init tcsh
chmod dumpkeys ipcalc mktemp rm touch
chown echo iptables-xml more rmdir tracepath
cp ed kbd_mode mount rnano tracepath6
cpio egrep keyctl mountpoint rpm traceroute

root@ZMESCMDZSW01 bin]# ls -alt ls
-rwxr-xr-x. 1 root root 117024 2月 13 19:01 ls
[root@ZMESCMDZSW01 bin]#

ls命令已经回到正常

修复top命令

[root@ZMESCMDZSW01 bin]# sftp root@192.168.1.72
Connecting to 192.168.1.72...
root@192.168.1.72's password:
sftp> cd /usr/bin
sftp> get top
Fetching /usr/bin/top to top
/usr/bin/top 100% 67KB 66.8KB/s 00:00
sftp> exit
[root@ZMESCMDZSW01 bin]# top---已经修复如下

top - 19:06:03 up 1 day, 22:58, 2 users, load average: 0.08, 0.20, 0.23
Tasks: 874 total, 2 running, 872 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.1%us, 0.3%sy, 0.0%ni, 99.6%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 32843076k total, 3720472k used, 29122604k free, 269876k buffers
Swap: 35078136k total, 0k used, 35078136k free, 964400k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
12680 root 20 0 1486m 322m 16m S 1.3 1.0 43:38.99 java
35593 root 20 0 15552 1884 952 R 1.3 0.0 0:00.11 top
242 root 20 0 0 0 0 S 0.3 0.0 0:15.04 ata/5
835 root 20 0 0 0 0 S 0.3 0.0 0:57.63 scsi_eh_1
3172 root 20 0 4060 304 216 S 0.3 0.0 5:05.42 cpuspeed
3175 root 20 0 4060 304 216 S 0.3 0.0 5:05.21 cpuspeed
3176 root 20 0 4060 304 216 S 0.3 0.0 5:05.23 cpuspeed
3179 root 20 0 4060 304 216 S 0.3 0.0 5:06.07 cpuspeed
3181 root 20 0 4060 304 216 S 0.3 0.0 5:06.50 cpuspeed
3183 root 20 0 4060 304 216 S 0.3 0.0 5:06.16 cpuspeed
3185 root 20 0 4060 304 216 S 0.3 0.0 5:04.56 cpuspeed
3188 root 20 0 4060 304 216 S 0.3 0.0 5:04.85 cpuspeed
3191 root 20 0 4060 304 216 S 0.3 0.0 5:03.31 cpuspeed
3192 root 20 0 4060 304 216 S 0.3 0.0 5:06.38 cpuspeed
3196 root 20 0 4060 304 216 S 0.3 0.0 5:06.70 cpuspeed
3208 root 20 0 4060 304 216 S 0.3 0.0 5:06.21 cpuspeed
3211 root 20 0 4060 304 216 S 0.3 0.0 5:06.61 cpuspeed
3212 root 20 0 4060 304 216 S 0.3 0.0 5:06.69 cpuspeed
3213 root 20 0 4060 304 216 S 0.3 0.0 5:04.78 cpuspeed
3215 root 20 0 4060 304 216 S 0.3 0.0 5:05.38 cpuspeed
3216 root 20 0 4060 304 216 S 0.3 0.0 5:06.55 cpuspeed
3217 root 20 0 4060 304 216 S 0.3 0.0 5:06.61 cpuspeed
3218 root 20 0 4060 304 216 S 0.3 0.0 5:06.26 cpuspeed
3219 root 20 0 4060 304 216 S 0.3 0.0 5:04.76 cpuspeed
3222 root 20 0 4060 304 216 S 0.3 0.0 5:06.65 cpuspeed
3223 root 20 0 4060 304 216 S 0.3 0.0 5:05.19 cpuspeed
3936 root 18 -2 12532 2844 584 S 0.3 0.0 4:34.98 udevd
26162 root 20 0 97636 3724 2892 S 0.3 0.0 0:00.41 sshd
39219 root 20 0 11.6g 260m 20m S 0.3 0.8 0:48.77 java
1 root 20 0 19328 1512 1212 S 0.0 0.0 0:04.12 init
2 root 20 0 0 0 0 S 0.0 0.0 0:00.17 kthreadd
3 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
4 root 20 0 0 0 0 S 0.0 0.0 0:00.21 ksoftirqd/0
5 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
6 root RT 0 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
[root@ZMESCMDZSW01 bin]#

搞坏这两病毒命令

[root@ZMESCMDZSW01 bin]# cd /sbin
[root@ZMESCMDZSW01 sbin]# ls tty*
ttyload20140208 ttymon
[root@ZMESCMDZSW01 sbin]# ls -alt tty*
-rwxr-xr-x. 1 122 114 212747 3月 10 2011 ttyload20140208
-rwxrwxr-x. 1 122 114 93476 3月 10 2011 ttymon
[root@ZMESCMDZSW01 sbin]# mv ttymon ttymon20140208
[root@ZMESCMDZSW01 sbin]# l
-bash: l: command not found
[root@ZMESCMDZSW01 sbin]#

find / -user 122 | xargs chown root:root

其他命令已经修复，等待观察。

相应的安全策略还在思考与制定中