服务器被人放了门罗币挖矿程序（XMRIG），能分析出来些啥吗

[wangfei324017]

大约 3-4 台服务器被发现中了，现在把这些文件彻底删除了，修改了电脑账号的密码，不知道这样子是不是就安全了……

{ "algo": "cryptonight", // cryptonight (default) or cryptonight-lite "av": 0, // algorithm variation, 0 auto select "background": false, // true to run the miner in the background "colors": true, // false to disable colored output
"cpu-affinity": null, // set process affinity to CPU core(s), mask "0x3" for cores 0 and 1 "cpu-priority": null, // set process priority (0 idle, 2 normal to 5 highest) "donate-level": 5, // donate level, mininum 1% "log-file": null, // log all output to a file, example: "c:/some/path/xmrig.log" "max-cpu-usage": 100, // maximum CPU usage for automatic mode, usually limiting factor is CPU cache not this option.
"print-time": 60, // print hashrate report every N seconds "retries": 5, // number of times to retry before switch to backup server "retry-pause": 5, // time to pause between retries "safe": false, // true to safe adjust threads and av settings for current CPU "threads": null, // number of miner threads "pools": [ { "url": "pool.supportxmr.com:5555", // URL of mining server "user": "43YVXSRrqzejHN1UNmQ9gtRhmRJQn472pbXoqmtsBeGZBf7w5eNXUVsWbwaVe4vUMveKAzAiA4j8xgUi29TpKXpm3x4ZNk7", // username for mining server "pass": "x", // password for mining server "keepalive": true, // send keepalived for prevent timeout (need pool support) "nicehash": false, // enable nicehash/xmrig-proxy support "variant": -1 // algorithm PoW variant } ], "api": { "port": 0, // port for the miner API https://github.com/xmrig/xmrig/wiki/API "access-token": null, // access token for API "worker-id": null // custom worker-id for API } }

[wangfei324017]

图片

[crab]

只改密码治标不治本啊（除非确定是因为密码被破解）
找出被入侵的原因吧。（建议是系统重装，而不是只改密码。）

[sphawkcn]

既然是服务器，那就不要用密码了，用密钥吧。

[wangfei324017]

@sphawkcn windows 服务器也可以用密钥嘛……

[wangfei324017]

@crab 3q

[Heyuan]

请问解决了吗，我重装系统还是会有这个矿木马

[wangfei324017]

@Heyuan #6 我好像把他删了就好了